Support for signing key on hardware security modules

[Cantor, Scott]

> > I just don't have a great way to recognize the two groups.
> 
> You could force a migration to a new key and a new set of endpoints.
> You already know how to do this but for the record, it goes something
> like this:

I know how to recognize them in general after the fact but identifying them automatically and without extra effort on my part is what I was referring to.

My problem is that I've not really documented the non-adhoc integrations to this pont so I'm left with a long history of different cases between InCommon, not InCommon, and InCommon but ignoring the metadata. It's that last group I need to identify, but generally speaking I can tell from the metadata once I look. If it's Shibboleth or SSP, they probably are ok and if not, almost certainly not.

-- Scott