SREG and AX keys aren't signed, so they are ignored by Drupal OpenID clients

Unless I'm mistaken, the security fix at http://drupal.org/node/1425084 (for the OpenID client in Drupal core) means that the OpenID Provider module is not signing the correct keys for a Drupal client to actually be able to use things like the username and email address from the OpenID response. The effect is that if you have a Drupal site talking to a Drupal site via OpenID, the login/etc won't work at all.

The attached patch adds 'sreg.nickname' and 'sreg.email' to the hardcoded list of signed keys, thereby allowing it to work with Drupal clients again. Does that look like the correct approach? (I'm not an OpenID expert at all.)

I'm not sure if it's correct to add other keys here too, or to leave it up to other modules to deal with that themselves in hook_openid_provider() (for example, there may need to be a corresponding issue filed with http://drupal.org/project/openid_provider_ax). But 'sreg.nickname' and 'sreg.email' are the ones that OpenID Provider adds itself in openid_provider_authentication_response(), so it seemed to make sense that it should sign those.

The patch should work for both Drupal 6 and Drupal 7.