pass keys as interface{} rather than []byte

This will allow clients to pass, for example, their own instances of
rsa.PublicKey if the key is not specified as some flavour of X509
cert. For example, Salesforce just specify the modulus and
exponent (https://login.salesforce.com/id/keys)
I don't think you need the if statement here.  `kid` will always be a string and it will be "" if the value in the type assertion is not a string.  See http://play.golang.org/p/Fx5v7OZvRE

Really, this whole method doesn't need to exist, since `Header` is exposed.  I'm not opposed to keeping it for convenience, but we should use it internally if it's going to exist.