Added support for transition to new signing certificate (added signing cert fingerprint to token header; when validating the token, the signing certificate is retrieved by the provided fingerprint; signing certificates at STS are stored in the PKCS12 keystore).