include SignatureValidation filter with FileBackedHTTPMetadataProvider

[Cantor, Scott]

> Yes of course. Basically what I'm trying to say is: If the file is NOT
> signed, you should not use FileBackedHTTPMetadataProvider.

I didn't really get that from what you wrote, but I'm not sure as a project we're taking the "TLS sucks" position, whatever my personal feelings, that's for others to decide. We provide extremely (as in the most anywhere) powerful control over TLS just like the SP does, so we intend that both be possible.

> Sure, I didn't mean to imply otherwise. If the file is not signed,
> presumably TLS is providing security, in which case use
> HTTPMetadataProvider (not FileBackedHTTPMetadataProvider).

The difference is one backs up, the other doesn't. There is nothing there that relates to the trust model used, you can use either with either.

> Same here. If the file is NOT signed, don't use
> FileBackedHTTPMetadataProvider since there is no integrity check at
> startup.

There is, though, and the IdP doesn't support skipping it yet.

> I could be missing something, I guess. I'm happy to revert the edit if
> that turns out to be the case.

Please revert it. I still don't know what you mean to say, but at present that text just doesn't make sense.

-- Scott