Disable PKI tokens by default

This was originally added in #6, but got lost along the way.