Credential, TrustEngine and CredentialResolver key and certificate relationships

[Brian Reindel]

I understand these concepts independently and what each is supposed to
do, but I'm not understanding how they are related to one another with
respect to the key and certificate.

In public and private key encryption, I would give the public
certificate to the other party to load into their truststore, which
they could use to encrypt messages to me. I would then decrypt with my
private key. However, I suspect there is more going on here. It might
be easier if I ask these specific questions:

(1) If I have a Credential in the relying-party.xml used by a
RelyingParty (defaultSigningCredentialRef), then what must I give the
SP for this Credential to work (and what must they do with it)?

(2) If I have a TrustEngine with a Credential in the
relying-party.xml, then what must I give the SP for this to work (and
what must they do with it)?

(3) If I have a CredentialResolver in the shibboleth2.xml, other than
making sure a key name and the certificate appear in the SP metadata,
what must I give the IdP for this resolver to work (and what must they
do with it)?

Thanks,