Questions about signing key pair in IdP

[Ina Müller]

Here some considerations coming in mind while reading about step 3 in 
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPKeyRollover - 
and my questions for clarifying things for me:

As I understand from the above article, the key pair for signing and the 
key pair for the SSL/TLS on port 8443 MUST always be the same and this 
single public key is published through <md:KeyDescriptor use="signing"> 
in metadata, right?

But from a plain technical view (or by wrong configuration) the key 
pairs could be different and I try to figure out what would break:
If the metadata KeyDescriptor does not match the SSL/TLS credentials, 
the SP refuses communication to IdP on 8443 at all?
If the metadata KeyDescriptor does not match the signing credentials, 
the SP refuses to accept the content of the SAML answer?

And one more question about key pairs and TrustManagement:
with <TrustEngine type="ExplicitKey"/> in the SP, there is none of the 
PKI mechanism like validation of RootCA/revocation lists/certificate CN 
or subjectAltName involved for both SSL/TLS on 8443 and SAML signing. So 
only the existence of <md:KeyDescriptor use="signing"> in metadata is 
sufficient for trust from SP side, right?

Ina