What's wrong in my Shibboleth SP 2.6.0?

[Peter Schober]

* Marco Malavolti <marco.malavolti at garr.it> [2017-03-16 10:43]:
> 2017-03-16 *09:41:59* INFO OpenSAML.Metadata : applying metadata filter (Signature)
> 2017-03-16 *09:45:27* INFO OpenSAML.Metadata : applying metadata filter (EntityRoleWhiteList)

Signature validation certainly is slow, though my smallish SP (1-2 GB
RAM, 1 vCPU) takes less than half the time (1.5 minutes vs. 3.5 for
yours) for our 29MB aggregate:

2017-03-16 11:57:56 INFO OpenSAML.Metadata : applying metadata filter (Signature)
2017-03-16 11:59:35 INFO OpenSAML.Metadata : applying metadata filter (RequireValidUntil)

On a different, equally minimal, system using `samlsign -c` as part of
a verification tool chain takes 1m 50s to validate that same 29MB
metadata document.
Btw, xmlsec1 takes 1.6 seconds (and less than 1s on repeated calls) to
verify that same file, on the same system. Though that might be due to
the SP (and samlsign) performing additional checks, not sure.
-peter