Only return signing keys that have a secret. Otherwise it will return any signing capable key, which is not the intention.
