This is based on c8114401 made against the
old "config" package implementations, but also catches a few other cases
where we would previously have printed the private key into the error
messages.