> with the upgrade to v2.6 the defaults for signing and encryption are > “conditional”, previously “false” Which does not require you to change anything. It will sign on the front channel (so your change isn't needed) and it won't encrypt unless the IdP provides a key for it to use. -- Scott