Metadata requireSignedMetadata=false Behavior

[Ian Young]

> On 9 Jun 2015, at 05:08, Nate Klingenstein <ndk at internet2.edu> wrote:
> 
> I would like to understand more about whether there is a legal difference between signing something yourself or saying "I have an MOU with this entity and they signed this".  I suspect there is, and that's one reason why I'm pushing on this.

I don't believe there's any inherent legal significance to either construct. Of course, people can enter into agreements with the intent of establishing whatever guarantees they would like, but to date federation operators (the people doing most of the signing you might care about) have understandably tended towards disclaiming liability to the maximum extent possible. That approach may not be sufficient for all applications, but it's where we are today, particularly when you take eduGAIN into account given that it's based on unilateral declarations instead of contracts.

    -- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5250 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150613/b94b2f2b/attachment.p7s>