Signing authN requests: yea or nay?

[Erdos, Marlena]

Apologies -- I know this topic of whether or not to sign authN requests
has come up before, but my attempts at searching haven't yielded enough
material for us to make a determination**.

Our inclination (as a soon to be live IdP) is to require signed authN
requests. 

Sure, we could encrypt the response  and let that serve as a guard against
unwarranted parties reading the assertion but I'm kind of against
solutions that are open to off-line attack even if one could say "who
would bother?"

Thoughts?

Thanks,
Marlena
**For example, Windows Azure won't accept signed authN requests (though
that site doesn't say why that I noticed); on the other hand  a note from
Scott Cantor from some years back which I found on a Terena site says that
signing can have technical advantages (with some specifics).