Oisin pki cinder

First stab at finding the places that Cinder will need to be changed to enable Keystone PKI.   Chose the name /tmp/keystone-signing-cinder .  Probably we need to standardize some scheme including the servicename. Be wary of the permissions on that file!...