Function load_ca_key_pem 

pub fn load_ca_key_pem(
    path: &Path,
    protection: &CaKeyProtection,
) -> Result<Zeroizing<String>>

Load the CA private-key PEM from disk, decrypting it when the file is an encrypted envelope. Returns a [Zeroizing] PEM so the crown-jewel key is wiped on drop. Used by the auto-gen path and by every issuance caller (the issue-client-cert CLI and the enrollment endpoint) before signing.