Decryption config

[Cantor, Scott]

I'm working on the default security configs again.

I'm a little confused about what I would need to do to supply the IdP's
decryption keys into the configuration, and how that aligns with the
defaults in the library.

I was thinking I should just supply my own instance of
org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver to
supply all the keys configured locally, but that seems to bypass all of
the KeyInfo resolution behavior in the default resolver that the library
configures. With the SP, it sort of merges the two to use the KeyInfo to
optimize the local lookup, is there something similar I should be doing
here?

Also, I probably need to override the default EncryptedKeyResolver to
include the SAML-based one in the chain, right?

-- Scott