The error occurs when an SP has no encryption key in its metadata and the IdP isn't configured to disable encryption or treat the lack as non-fatal. -- Scott