Documentation issue: Remote caching

Documentation URL: https://docs.bazel.build/versions/master/remote-caching.html

Where is the documentation for how to provide bazel options to use grpcs as a remote cache? In particular, what formats are the keys and certs supposed to be in? I used:

bazel build \
  --remote_cache=grpcs://192.0.2.42:8086 \
  --tls_certificate=ca.pem \
  --tls_client_certificate=client.pem \
  --tls_client_key=client-key.pem \
  //...

and got a complaint about the client key being in the wrong format. Some searching revealed that it should have been in PKCS#8 format, so I converted it and ran:

bazel build \
  --remote_cache=grpcs://192.0.2.42:8086 \
  --tls_certificate=ca.pem \
  --tls_client_certificate=client.pem \
  --tls_client_key=client-key.p8 \
  //...

Which gave me the singularly unenlightening message: ERROR: Failed to query remote execution capabilities: General OpenSslEngine problem (I guess saying what the problem was is too much effort?)

The help message isn't enlightening either:

$ bazel help build | grep tls_client_key
  --tls_client_key (a string; default: see description)

What description?