draft-04 of Holder-of-Key Assertion Profile

Draft-04 of the "SAML V2.0 Holder-of-Key Assertion Profile" has been
uploaded to kavi:

http://wiki.oasis-open.org/security/SAMLHoKSubjectConfirmation

Most of the changes in draft-04 were in response to comments from
Scott, but I also took this opportunity to expand on the example and
add some clarifying text where appropriate.  See the diff for details.

There are at least two issues outstanding.  First, should we specify
the certificate bound to <ds:X509Certificate> to be DER-encoded or
leave the encoding unspecified (as suggested by Scott).  Second,
should a conforming IdP be required to support the entire specified
content model of <ds:X509Data> or is <ds:X509Certificate> sufficient
(as it is specified now).

Tom