Re: [wss] SAML Token Brainstorming

Some of the things I said in my last msg were required
are not required. Specifically, neither of the confirmation methods
require that assertions contain authority signatures.
Relying parties SHOULD require that assertions that contain or
identify a confirmation key be signed.