Small improvements towards support of PKCS8 privkeys.
Unfortunately we can't seem to read the PEM file yet, at least we get a more
reasonable error message and no stack trace.
Number of (security) improvements:
- Use SHA256 instead of SHA1 by default
- Use SHA256 for smime
- Use default SecureRandom algorithm, which is typically better than the SUN
  built-in
- Handle empty password as absent password instead of too short password
- check that CPS has been checked instead of failing at submission.