include SignatureValidation filter with FileBackedHTTPMetadataProvider

[rdw at steadingsoftware.com]

>> 
>> OTOH, if the metadata is not signed, what should the default action of
>> the software be? I believe it should go out to the network by default.
>> 

Presumably because although you were prepared to trust it yesterday, you are not prepared to trust it today? Indeed today you want to trust something else (presumably unsigned)?  I guess that this has something to do with the timing of the transitive nature of TLS trust?

R