Improve SSH key diagnostics

This would reduce the number of support issues that trip up users.

We already check that the private and public keys both exist (but I don't think we have a unit test for that).

In addition, we should

• Check that the private key is passwordless (see how at http://incubator.apache.org/whirr/faq.html#Can_I_specify_my_own_private_key).
• Check that the private and public keys belong to the same pair (via, e.g. http://s.apache.org/MNY).