XML signature with samlsign and xmlsec1

[Peter Schober]

* Paolo Smiraglia <paolo.smiraglia at gmail.com> [2018-06-29 09:47]:
> Now, if I try to verify the signed metadata with "samlsign",
> everything goes well. On the contrary, if I try the same process
> with xmlsec1, the signature verification fails due to the presence
> of multiple <KeyName> elements.

Since this is not the list for xmlsec1 what is it you're asking here?
Whether what samlsign did is technically correct?

How are you calling xmlsec1? E.g.

$ xmlsec1 --verify --id-attr:ID \
  urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor \
  --trusted-pem $CERT --pubkey-cert-pem $CERT $XML

Does XmlSecTool verify the signature? Does the Shib IDP or SP?

-peter