default IdP metadata for Shib IdP V3

[Tom Scavo]

This has probably been discussed before so please forgive me if this is a FAQ.

I'm working with an IdP operator to register their metadata with
InCommon. For comparison, they sent me a copy of the (static) metadata
spit out by the software (see below).

I know what the encryption certificate is for (IdP V3 supports inbound
encryption) but why are there two signing certificates?

Note: The three certificates are the same in both the IDPSSODescriptor
and the AttributeAuthorityDescriptor.

Thanks in advance,

Tom

<!--
     This is example metadata only. Do *NOT* supply it as is without review,
     and do *NOT* provide it in real time to your partners.

     This metadata is not dynamic - it will not change as your
configuration changes.
-->
<EntityDescriptor ...>

    <IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
        ...
        <KeyDescriptor use="signing">
            ...
        </KeyDescriptor>
        <KeyDescriptor use="signing">
            ...
        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            ...
        </KeyDescriptor>
        ...
    </IDPSSODescriptor>

    <AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
        ...
        <KeyDescriptor use="signing">
            ...
        </KeyDescriptor>
        <KeyDescriptor use="signing">
            ...
        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            ...
        </KeyDescriptor>
        ...
    </AttributeAuthorityDescriptor>

</EntityDescriptor>