Add ability to have key and certificate

Firefox seems to require the token to store the private key and the
certificate, so you can't simply use a token for a private key and an
external certificate.  Thus we add the ability to specify a
certificate instead of a public key.  In that case, the token will
have three objects: the certificate, the public key (extracted from
the certificate) and the private key.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>