Make digest explicit in all signing operations rather than defaulting, for clarity.
Switch over to requiring the java.security file to be *not* modified, instead referencing the Sun PKCS11 provider and the appropriate configuration file directly.
Add a property defaulting system to allow things like the PKCS11 configuration file location property to be platform-specific, or specified by a non-source-controlled local override file (build.properties).  This needs a little work to handle Linux for the Feitian card.