include SignatureValidation filter with FileBackedHTTPMetadataProvider

[Cantor, Scott]

> Please review this added security consideration:

I don't really understand what you're trying to get at with it.

If the file is signed, then you should use the filter, if not, not. The backup file is not something that should be factored into the determination, and the SP now doesn't generally even get told to do the check on the backup copy anymore (the IdP doesn't have that feature yet but probably will in the future).

And, really, nobody uses the HTTPMetadataProvider to begin with (should we even be exposing it?), but if you did, you certainly wouldn't omit the signature check if the file was signed.

Just not sure what this is trying to say, but it shouldn't say this.

-- Scott