sp signingAlg and digestAlg defaults and setting explicit values

[Cantor, Scott]

I do see one code path in a library that's falling back to signing with SHA-1 instead of conditionally using SHA-2 if OpenSSL supports it. There are two code paths in the file and one is different from the other, and I suspect that's a bug.

I don't know the circumstances in which one or the other would be used, but that probably would explain why it might be defaulting wrong, and that's a bug.

The SP of course doesn't sign all that often by design, so that's probably why it has escaped notice.

I'm probably going to be considering a rather artifical bump to 3.5.0 to do some library cleanup work, that would be a good time to "fix" a broken default without doing it in a patch.

-- Scott