feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

backend/fleet/src/Fleet.Identity/NodeCertificate.cs

@@ -22,7 +22,7 @@ public static class NodeCertificate
         return certificate.Export(X509ContentType.Pfx);
     }
 
-    public static X509Certificate2 LoadPfx(byte[] pfx) => X509CertificateLoader.LoadPkcs12(pfx, null);
+    public static X509Certificate2 LoadPfx(byte[] pfx) => X509CertificateLoader.LoadPkcs12(pfx, null, X509KeyStorageFlags.Exportable);
 
     /// <summary>证书公钥（SPKI）的 SHA-256：对端用它来固定这张证书。</summary>
     public static byte[] SpkiFingerprint(X509Certificate2 certificate) =>