enrollcertificate.sh should support encrypted private keys

Some WiFi connection managers will require an encrypted private key to be able to use them.

This could be handled by a switch in the execution which will later prompt for a password and encrypt the private key:
```
openssl rsa -aes256 -in unencrypted.key -out encrypted.key
```