updating SP's signing cert in metadata

[Tom Scavo]

On Fri, Oct 13, 2017 at 5:13 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * IAM David Bantz <dabantz at alaska.edu> [2017-10-12 20:45]:
>> metadata markup says the cert is for signing; can I rely on that?
>
> Well, you could check if their messages are in fact signed.

It's not that simple. A KeyDescriptor with use="signing" is used for
authentication at the TLS layer as well. For example, if the SP
metadata contains an AssertionConsumerService endpoint that supports
the HTTP-Artifact binding, a "signing" certificate is needed to
resolve an artifact at the IdP.

Tom