If the sasl mechanism is EXTERNAL, send the certfp in the initial S message.