Validating metadata signature based on key in metadata

[Rod Widdowson]

> If your key is issued by some CA I trust with this yes

In that case you still have externally defined trust - in that case it is trust in the CA.    You still configure it the same way, you plug an appropriately configured trust engine into the filter. In this case a PKIX one, for instance:

http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngine.java?revision=729&view=markup

I'll mentioned that experience in several thousand campus sites has proven that PKIX can be an incredibly painful way to try to trust metadata, others on the list can give you the gory details involved.  Anyway YMMV.