Receiving code can't handle the case of a Thumbprint reference to a BST in the token

If the receiver of a message does not have the certificate that is referenced by a Thumbprint SHA1 reference in its keystore, it can't validate the signature. It should search to see if the matching certificate is in the security header, as per the Reference case.