[PATCH v2 4/6] pem: refactor to expose pem iterator privately