Fixing #2028 - Better failures when a cert is found with no key

The problem was that the server had a certificate
for the client. Initially the client just didn't have a
key, because it assumed that if it had a certificate then
it had a key. Upon fixing it to create the key, the key then
did not match the found certificate.

This commit fixes both of those: The key is always found
before the certificate, and when the certificate is found
it's verified against the private key and an exception
is thrown if they don't match.

It's always a failure, so this just makes the failure
more informative.

Signed-off-by: Luke Kanies <luke@madstop.com>