According to Tomasz we should set it to  /var/lib/nova/keystone-signing (from nova changes):

Thu May 23 12:24:42 UTC 2013 - tpaszkowski@novell.com
 
 - set default value for signing_dir to /var/lib/nova/keystone-signing. This
   prevents problems on SLE11 where init script is called by the user (eg. root)
   and os.path.expanduser prefers HOME enviroment variable insted of passwd
   file.

I also remember issues with $HOME when running as root, not only with nova but that was earlier in the Grizzly dev cycle.