I am the Keystone dev that wrote the PKI token code. Here is my guide to troubleshooting it. http://adam.younglogic.com/2013/07/troubleshooting-pki-middleware/