The lxc command only needs a client.crt/client.key pair when connecting to a remote private LXD instance over HTTPs.
In the past (2.0) we were being a bit lazy and just always generated the keypair if missing, in newer releases, we decided to stop burning CPU needlessly and instead will only generate the keypair the first time you use lxc remote add to add such a remote LXD server.
So short answer is run lxc remote add with the URL of a remote LXD server and without passing --public and you’ll get a keypair generated.