security: In BasicIdentityStorage.addCertificate, use KeyLocator.getFromSignature to be signature algorithm-independent.