One can now restrict providers to specific SSO groups.

Uses the clientutil.Backend abstraction for the keystore client API.

Panic on short reads and other errors.

Signs SAML assertions for users authenticated via the SSO mechanism.