Use signing key on HSM to sign assertions

[Cantor, Scott]

> The third thing I think it's vanishingly likely we'd want to get into would be
> having the actual applications grow support for a separate cryptographic
> framework that wasn't mediated by the Java crypto API. We rely on things
> like Santuario for XML DSIG that would make those essentially rewrites.

Yes, that's a good point, I doubt there's any practical way we could isolate specific operations to offload in that fashion, since we aren't even actually performing them in most cases. It's JCE or nothing.