To properly support HTTPS, we shouldn't make the private key and certificate publicly available. We should have a rake task that automatically generates a pk and cert on a machine - the workflow I'm thinking is as follows:
"rake deploy" starts up appscake
this task depends on "rake cert", which does nothing if the cert/pk exists, and generates it otherwise