Datum.ProtectedData::ProtectedDatum:Certificate with PFX File and Password as Parameter

[ChristophHannappel]

I'm building my config on an Azure DevOps 2020 onPrem Worker.
I've encrypted the credentials with a Document Encryption Certificate and set the Certificate Thumbprint at the Datum.yml with

DatumHandlers:
  Datum.ProtectedData::ProtectedDatum:
    CommandOptions:
      Certificate: 'Cert:\CurrentUser\My\<Thumbprint>'

Before the build.ps1 is called my pipeline adds the certificate to the CurrentUser certificate store and after that it gets removed.

While the build is running another build process on a different worker agent on the same server with the same user context could access my private key.

The ProtectedData Module supports the use of an unlocked x509 object Protect Data and Unprotect Data (the basics)

# Note:  passwords may also be passed to the X509Certificate2 constructor as SecureString objects.
$cert = New-Object System.Security.Cryptography.X509Certificate2('C:\MyCertificate.pfx', 'MyPassword')

$decryptedString = $protectedData | Unprotect-Data -Certificate $cert

Would it be possible to add a parameter to the build process which either accepts an unlocked x509 object or the the path to the pfx file and a password?
In both scenarios i'd be able to use my pfx file as a secure file and the password as a protected variable
Something like

- task: DownloadSecureFile@1
  name: DatumCertificate
  displayName: Download Datum Document Encryption Certificate
  inputs:
    secureFile: '$(documentEncryptionCert.secureFileName)'
- task: PowerShell@2
  name: build
  displayName: 'Build DSC Artifacts'
  inputs:
    targetType: 'inline'
    script: |
      $cert = New-Object System.Security.Cryptography.X509Certificate2('$(DatumCertificate.secureFilePath)', '$(documentEncryptionCert.password)')
      './build.ps1' -tasks build -ProtectedDatumCertificate $cert

or

- task: DownloadSecureFile@1
  name: DatumCertificate
  displayName: Download Datum Document Encryption Certificate
  inputs:
    secureFile: '$(documentEncryptionCert.secureFileName)'
- task: PowerShell@2
  name: build
  displayName: 'Build DSC Artifacts'
  inputs:
    filePath: './build.ps1'
    arguments: '-tasks build -ProtectedDatumCertificatePath $(DatumCertificate.secureFilePath) -ProtectedDatumCertificate $(documentEncryptionCert.password)'