[security-services] Second draft of XML signature guidelines

Here's a second draft, with various corrections made to areas that were
flat wrong.

I have not changed the section on Transform profiles yet, since I think
that's open to more questions than I'm prepared to answer yet, but the
really egregious errors should mostly be fixed.

-- Scott