A couple of follow ups from yesterdays conversation

[Rod Widdowson]

I have made the control of the resolver plugins and the encoders via an
attribute "activationCriterionRef "  What was there before was disparate and
confusing. 

I checked and the signing credentials are considered when constructing a
ProfileObject 
  - attribute "signingCredentialRef" on the definition if present else
  - attribute "deaultCredentialRef"on the parent RelyingParty else
  - nothing.

In the first two cases the result is the injection of a
SecurityConfiguration with but one non-default value - a
BasicSignatureSigningConfiguration set as the signingCredentials.  This last
also being a default save for the provided credentials.  If I understand the
conversations with Brent and Scott correctly, this SecurityConfiguration
will be cascaded with with the per profile defauilt, then the per IdP
default and finally the OpenSAML default.

Rod