Another SecurityException: Could not resolve key encryption credential

[Christopher Hall]

Of course you’re right and the metadata being used by testshib did not match my the latest version of SP metadata for that entityID. Thanks for pointing out the obvious - I must have regenerated the certificate at some point with that entityID. 

However, no matter how many times I updated the metadata on testshib the IDP always tried to encrypt against certificate credentials uploaded the first time.

My resolution to this was to change the entityID only and all worked fine.