On 9/20/11 4:42 PM, "Martin Unger" <martin.unger at gmail.com> wrote: >Wow, that was quick :-) I forgot to set the assertion-ID. You should file that as a bug if it's actually letting the operation proceed. It's not a fatal flaw because whole document signing is generally safe, but it's better if the code just prevents invalid signature profiles. -- Scott