what controls assertion signing?

[Cantor, Scott]

> If IDP config doesn't trump what others put into metadata you shoulf
> file a bug, IMO.

It does, in fact. We didn't see it as a bug because metadata is never viewed as something somebody can accidentally inject bad data into, it's always implicitly trusted. Apart from performance, there's no real impact to signing them.

We can argue about what "never" should have meant, but that's what Chad defined it to mean ("never, except when metadata says to").

That said, I think I completely forgot to implement that flag in V3. So my inclination right now is to just define a property for whether to honor it, and default it true to match V2 behavior.

-- Scott