I think I would prefer:

```ruby
default["openstack"]["pki"]["enabled"] = false
```

And then write UUID or PKI into the token_format of Keystone keystone.conf accordingly (and signing_dir in the auth_token middleware paste INI files). That way, we keep the "signing" stuff all in Keystone (since it's where it is in the [signing] config section and have a single boolean flag to enable PKI