For the .NET 4.6 build, use X509Certificate2.GetRSAPublicKey() as this returns an RSACngAdd IConfigurationResolver for dynamic resolution of SAML configuration.
Make exception constructors public so they may be thrown by custom classes implementing interfaces.