Bug 142172
Bug 142172

1) look up the private key much earlier in the process so we know what slot it is on.
2) if a slot isn't specified, you the private key's slot.
3) if the specified slot and the private key slot don't match & the private key slot can do the PBE, then use the private key slot to do the PBE so we don't have to move the key.
4) if we have generated the PBE key in a different slot from the private key,

nmav/nss,ekr/nss-old,nmav/nss,ekr/nss-old,nmav/nss,nmav/nss,nmav/nss,ekr/nss-old,ekr/nss-old,ekr/nss-old,nmav/nss,nmav/nss,ekr/nss-old,ekr/nss-old