pass keys as interface{} rather than []byte

This will allow clients to pass, for example, their own instances of
rsa.PublicKey if the key is not specified as some flavour of X509
cert. For example, Salesforce just specify the modulus and
exponent (https://login.salesforce.com/id/keys)