signResponses

[Cantor, Scott]

I don't know who's asking you to "prove it" or why, but it bears noting that signing something proves nothing when you have no proof the other end is verifying anything.

The only way to prove anything (at a point in time, since it could change literally a minute later) is to pentest a relying party by modifying a message and checking for failure (and that result is system and implementation dependent so can't easily be automated).

What matters is what the SP does, basically, not what an IdP sends it.

-- Scott