Some *privateKeyPem outputs contain hashes, not PEM data

[nhinds]

The SelfSignedCert.privateKeyPem and CertRequest.privateKeyPem outputs are both documented as:

PEM-encoded private key that the certificate will belong to

Similarly, the LocallySignedCert.caPrivateKeyPem output is documented as:

PEM-encoded private key data for the CA.

However, all 3 of these outputs really contain some kind of hash of the private key input, rather than the private key itself. This is consistent with the upstream Terraform documentation for e.g. tls_self_signed_cert:

Only an irreversable secure hash of the private key will be stored in the Terraform state.

I understand that the Pulumi docs are generated from the Terraform docs, but is there any way to override the documentation for these 3 fields to explain that the fields really contain a hash of the private key? Or to rename the fields privateKeyHash / caPrivateKeyHash, since they don't contain any PEM data?

Reproduction:

import * as pulumi from "@pulumi/pulumi";
import * as tls from "@pulumi/tls";

const key = new tls.PrivateKey("key", { algorithm: "ECDSA" });
const selfSignedCert = new tls.SelfSignedCert("crt", {
  isCaCertificate: true,
  subjects: [ { commonName: "crt", }, ],
  keyAlgorithm: "ECDSA",
  allowedUses: [ "cert_signing", "crl_signing", ],
  privateKeyPem: key.privateKeyPem,
  validityPeriodHours: 365 * 24,
});
export const keyPrivateKeyPem = key.privateKeyPem;
export const selfSignedCertPrivateKeyPem = selfSignedCert.privateKeyPem;

const key2 = new tls.PrivateKey("key2", { algorithm: "ECDSA" });
const certRequest = new tls.CertRequest("certRequest", {
  keyAlgorithm: "ECDSA",
  privateKeyPem: key2.privateKeyPem,
  subjects: [ { commonName: "locally-signed", }, ],
});
const locallySignedCert = new tls.LocallySignedCert("crt", {
  certRequestPem: certRequest.certRequestPem,
  caCertPem: selfSignedCert.certPem,
  caPrivateKeyPem: key.privateKeyPem,
  caKeyAlgorithm: "ECDSA",
  allowedUses: [ "cert_signing", "crl_signing", ],
  validityPeriodHours: 365 * 24,
});
export const key2PrivateKeyPem = key2.privateKeyPem;
export const certRequestPrivateKeyPem = certRequest.privateKeyPem;
export const locallySignedCertCaPrivateKeyPem = locallySignedCert.caPrivateKeyPem;

After pulumi up, the outputs show that while the 2 PrivateKey.privateKeyPem outputs return a PEM-encoded certificate, the other 3 return hashes:

Outputs:
    certRequestPrivateKeyPem        : "ba4b0e4e58590c12c7fa53f0fd6e085c6229e8fa"
    key2PrivateKeyPem               : "-----BEGIN EC PRIVATE KEY-----\nMGgCAQEEHMe6jwbDrXN+jQVaqAtBtHFRRclv3oFC3tNAW5CgBwYFK4EEACGhPAM6\nAAQLPMFTzVj0eTL6sUywk9mw9qYjpwhadUCd/j8armzU6N2VooZVbwlxAhcEXPPs\nHVmyQpmKKfR23Q==\n-----END EC PRIVATE KEY-----\n"
    keyPrivateKeyPem                : "-----BEGIN EC PRIVATE KEY-----\nMGgCAQEEHNl5/fpQ9Xd4XNfuhUx2yt4KSG+G1jlpovXgJIOgBwYFK4EEACGhPAM6\nAAR8n8CchzPI4f0zmlBi2TetfrkAofDiWkJ/GKa1FWFiMNH5W2bnmKW3mEiWq5Et\n8ueSgNzLsXDqYw==\n-----END EC PRIVATE KEY-----\n"
    locallySignedCertCaPrivateKeyPem: "61b5f689025d58c0aa9d5fecc8ab5154f54ecfbc"
    selfSignedCertPrivateKeyPem     : "61b5f689025d58c0aa9d5fecc8ab5154f54ecfbc"

[iwahbe]

@susanev Thanks for moving this issue over to pulumi-tls (and bringing it to our attention). We can't do anything about it right now, but this is an excellent test case for our "user edited docs" work stream.