assertion signing defaults for IdP v3 vs v2

[Mark K. Miller]

So, I think I've navigated down the path of converting my legacy mode 
files to native v3 files (which seems like 'mostly' just the 
relying-party.xml file.)  Along the way, I think I noticed two things that 
strike me as 'odd.'  I'd greatly appreciate if those far more expert than 
myself could share their thoughts.

First, do I just not have a clue, or did the defaults for assertion 
signing change between v2 and v3.  For the DefaultRelyingParty, the 
SAML2SSOProfile was set to signResponses="never" signAssertions="always" 
(which I believe was the default config.)  However, according to some 
observed behavior, and my interpretation of this page: 
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-SystemProfileDefaults
it seems that the v3 default is to sign responses, but not sign 
assertions.

Second, what 'forced my hand' about converting to native mode was an SP 
that couldn't handle SHA-2.  Once converted to native mode, I followed the 
example for "Per-Profile Signing Algorithm" shown on this page: 
https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionConfiguration
To my surprise, after activating that example code for the SP in question, 
it still didn't work!  The SP only started to work again after I changed 
the SAML2.SSO bean in that example to look like this:

<bean parent="SAML2.SSO"
       p:securityConfiguration-ref="SHA1SecurityConfig"
       p:signAssertions="true" />

Obviously, this relates to an SP that is configured for signed assertions, 
but isn't checking response signatures.

Am I just too easily confused?  Did I just completely miss any 
discussion/documentation about changing the signing defaults?  If the 
defaults really did actually change, is there a pointer to something that 
could help me understand that choice?

Sure I understand how to configure this stuff back to how my v2 IdP 
worked, but is that the best choice to make?

Thanks,

Max