I have a situation where I need to pass --enabled-key-data to xmlsec1.
Our current solution is to use a monkey patch to add this switch to the CLI used to call xmlsec1. It'd be nice to able to supply any extra xmlsec1 cli args in the Sp configuration.