Re-work sigul to support using pesign with HSMs

[jeremycline]

At the moment, sigul doesn't use pesign with an HSM and this is apparently a requirement for anything signed with the cert baked into a Microsoft-signed shim.

We need to adjust Sigul to support this and then ensure any adjustments on the client side also happen here. It might be that we can avoid making any changes outside of the server have of Sigul itself since it seems reasonable that it can tag particular keys as residing in an HSM and thus knows to adjust its pesign call without the client knowing or caring.