Different from the other options, setting it to null does not use
a default but throws an error if you enable metadata signing, so
enabling metadata signing in the default config will throw an
exception. Better to just leave it out, the option is documented
but should not be necessary for most installs, so needs not be
in the template.