Refactor Signature + Encryption referencing

Currently we specify a Signature or Encryption KeyIdentifier, e.g. "IssuerSerial". We should add the ability to take in a DOM Element corresponding to a SecurityTokenReference received as part of a WS-Trust exchange, and use this instead to reference a Key.