This allows loading the X.509 certificate from an OpenSSL provider instead of a file system path. This allows loading certficates directly from hardware tokens instead of having to export them to a file on disk first.
It's been split into a bunch of files and deserves its own subdirectory similarly to systemctl.