Enable PKI tokens for keystone

This switches from UUID based tokens to PKI tokens. Tokens get signed by
keystone, services can validate the token without having to communicate
with keystone API. This setup is using self signed keystone generated
certs as the certs are only used within the services.

Introduces a new variable, countrycode, used when generating keystone's
signing cert.