SP metadata that supports both sha1 and sha2?

[Cantor, Scott]

> > My impression is that they're planning on rolling out a new signing cert as
> > part of their move to sha256.
> 
> No, they're rolling out a new encryption key

I should say, they’re updating both because they happen to have coupled them. It may be that they screwed up and really didn't mean to change the encryption key but got trapped into doing it because of a (wrongly) perceived need to change the key to switch the metadata signature to SHA-2.

Lots of people get all worried about the fact that certs themselves are signed internally by SHA-1, but that only matters if somebody's actually verifying that signature (i.e., the key's not self-signed and/or trusted out of band).

There's so much confusion in what they're doing it's hard to tell where it ends.
 
-- Scott