Allow token signing key/cert/cacert to be pulled in remotely

Currently, we run a pki_setup if auth strategy is 'pki' (default).  If
you have multiple keystone nodes load balanced, they'd all have
different keys/certs/cacerts (created by the pki_setup).  This change
allows you to pull in a custom key/cert/cacert so that these files can
be uniform across all nodes.

Change-Id: I8f0fa41e4433e3a44247fc467e3f6b5f0d2e203d