Use signing key on HSM to sign assertions

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2018-05-07 15:37]:
> I believe xmlsectool has some tested support for using PKCS11 for
> signing

That should work fine, IIRC. Rainer published some examples at
https://github.com/identinetics/keymgmt/blob/master/install/tests/test_hsm_token.sh#L346

But maybe the IDP (and XmlSecTool, while we're at it) should grow
support for the pyeleven "API"? https://github.com/IdentityPython/pyeleven

HSM integration is limited to the proxy that way, and the client only
sends the digest and receives the signed digest via JSON over HTTP.
(Securing that HTTP connection is left to the deployer.)

That may serve as yet another reason to standardize the pyeleven API a
bit (cf. https://github.com/wayf-dk/goeleven).

-peter