Signature validation filter config

[Cantor, Scott]

On 4/14/14, 10:21 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>With it true SignatureValidationFilter complains if the signature fails
>or if there is no
>signature.  My feeling is that having the default be false opens up to an
>attack in which unsigned metadata is provided as a replacement to signed
>metadata.

Yeah, that seems pretty weird, and it seems pretty unlikely that anybody
is counting on that behavior.

-- Scott