Metadata "trust"

[Cantor, Scott]

> Not to mention that there's nothing precluding the metadata at, say,
> www.providerA.com from "accidentally" including bogus data for an
> entityID for competitorB.com (this is one of the reasons why
> automatically loading metadata, even signed metadata, is risky).

That's true, but you can just apply a whitelist filter to limit that. There's also (in the SP) the Dynamic plugin that will just go after a single entity's metadata on the fly.

-- Scott