We should log expiration issues. A root cause of Issue #2985

We don't give the IdP developer any feedback when we see expired or certs without an iat field.

See Issue #2985 for details.