Function certified_key_from_pem 

pub fn certified_key_from_pem(
    cert_chain_pem: &str,
    key_pem: &str,
    provider: &CryptoProvider,
) -> Result<CertifiedKey, CertError>

Parses a certificate chain and private key, both PEM, into a [CertifiedKey] rustls can serve.

Refuses a key that does not match the leaf. rustls would load such a pair and then fail every handshake it is used for.

cert_chain_pem is the leaf followed by any intermediates, in the order a CA hands them back — instant_acme::Order::poll_certificate already returns them in that order.