Metadata "trust"

[Tom Poage]

I have a vendor telling me their decision to use an X.509 certificate
signed by a well-known CA as SP encryption/signing key is to satisfy
some clients requiring identity verification by a third-party CA (cf.
high-assurance, EV, ... certs).

The same also tells me to to use their
https://.../Shibboleth.sso/Metadata URL with a
FileBackedHTTPMetadataProvider in our IdP to accommodate key/certificate
rollover when this encryption/signing certificate expires in three years.

I haven't convinced myself to buy into this quite yet, except ...

Section 4.3.3 (third bullet) of the saml-metadata-2.0 doc suggests (to
me) fetching metadata over an SSL/TLS connection is sufficient as long
as I trust the server. OK, so XML digital signature is perhaps not
absolutely required to "trust" the metadata.

Down side, the SP /Metadata URL does not provide a validUntil nor a
digital signature, and I don't know if /Metadata end point knows how to
respond to HTTP If-Modified-Since (doesn't appear to), so it looks like
I'd need to poll every so many hours/days (maxRefreshDelay).

As long as the vendor adheres to good key rollover practice, cf.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMultipleCredentials,
then this might be workable.

I'm wondering if the vendor is perhaps confused over differing roles of
the web server certificate vs. the SP encryption/signing cert.

Comments/suggestions/guidance?

Thanks.
Tom.