Keep signing certificates / keys in config.xml rather than on disk; allow configuration.