SP - How to require an encrypted assertion?

[Peter Schober]

* Marc Boorshtein <mboorshtein at gmail.com> [2015-03-16 04:33]:
> On apache 2.2 on CentOS 6.x.  I have encrypted assertions working,
> but I can't figure out how to enforce that only encrypted assertions
> are allowed.

I don't think you can. And with that you'd also rule out Attribute
Queries, which are "secure" as they don't involve passing data over
the HTTP User Agent, and establish a secure channel from the SP to the
IDP/AA via mutual TLS authentication.

Is this part of a formal threat/risk analysis involving a study of
signed (but unencrypted) and encoded data available in the HTTP User
Agent? Or just a case of "encrypted always is better than unenctypted"?
-peter