Warn about using a client cert that isn't what is specified in the metadata

[joesiltberg]

Probably needs a new option/command line parameter so we know under which entity id to check in order to generate this warning.