First @Church- are you fine with this? I kept you as an author but added myself as a co-author.
@midchildan you also gave feedback on the original pull request. Would you like to give some again?

Motivation for this change

#97225 stalled and there is no local certificate authoritiy which can e.g. be used instead of letsencrypt for local deployments or testing.

Things done

nixos: Adding module for step-ca, set up by default to allow for both regular x.509 certs and SSH certs as well.
Also add a possibility for ACME and implement systemd hardening. Addressed all feedback from the original PR.

Edit: I will fix the EditorStyle complaints tomorrow (and also the TODOs that are easy to fix)

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.