Generating them unconditionally caused a problem with the init script:
the script required there to be a certificate for the private key if
the private key existed, but we do want to allow TCP-only configurations
and always having a private key prevented that.
Also, give the user advice on how to deal with this problem when it
arises in the init script.
Ben Pfaff