I continue to be regularly annoyed when I want to go snag the token signing certificate out ACS for use with federating to my various projects, like SharePoint sites. I've written in a couple or more blog postings about how you go to your tenant, find your federation metadata xml endpoint, retrieve the Xml from the browser, paste it in notepad, find the cert, copy it out, paste it in a new notepad instance, and save it as a certificate. In a word, ridiculous. So I finally just wrote a stupid little app to do all that for you. All you have to do is give it your ACS instance name - like if your ACS instance is at contoso.accesscontrol.windows.net then you just give it "contoso". You tell it where you want the token signing certificate saved, click a button, and that's it - all done.
I've attached it here along with the source code, so hope you find it useful.