Fix findBestByMailbox sign key selection

Only return signing keys that have a secret. Otherwise it
will return any signing capable key, which is not the intention.