PKCS12 objects have the following methods:
The optional passphrase must be a string not a callback.
See also the man page for the C function PKCS12_create.
Set cacerts to None to remove all CA certificates.