> It seems a bit strange to me to accept string types or callable in the 
> same argument.  If it just supported strings, people could still write
> password=somefunction(), right?

The function is only called if the private key is encrypted and a 
password is necessary.  This allows the code to only prompt for a 
password if it is actually needed.

This also parallels the OpenSSL C API, which only accepts a function to
get the password.  I added support for plain strings as a convenience.  
The string argument will be ignored if the file is not encrypted.