AcquireSource establishes a connection to the workload API, fetches the X.509 bundle, and returns an X509Source.

CreateCryptoKey generates or reuses a cryptographic key pair for the application, taking an id for logging purposes and a channel updatedSecret to signal when the secret has been updated.

Monitor listens to various channels to track the progress of acquiring an identity, updating the age key, and starting the server.

NotifyTimeout waits for the duration specified by env.SafeBootstrapTimeout() and then sends a 'true' value to the provided 'timedOut' channel.