how to handle semi-configurable aspects of keychain

[kwatsen]

This issue is being discussed on list here (https://www.ietf.org/mail-archive/web/netconf/current/msg11236.html), but I don't think that we're close to resolution yet, so marking it as an issue here so it can be tracked...

[kwatsen]

• added private-key as a configurable node (nacm:default-deny-all)
• removed generate-private-key and load-private-key actions