These certificates and private keys are test-only loopback fixtures and must never be trusted by the production application.

`localhost-ca-cert.pem` is a private CA. `localhost-cert.pem` is a CA:FALSE
serverAuth leaf for `localhost` / `127.0.0.1`, valid 397 days so Apple's TLS
server policy accepts it. Regenerate with `./generate` (needs OpenSSL).
