Security domains need to be able to transform a SecurityIdentity before handing it to the caller, in order to add (e.g.) a PeerIdentity for PicketBox integration, etc.