Notwithstanding the correctness of it, I checked and the SP doesn't include a CA flag, but the IdP does. I filed a ticket to turn that off if we can, there's no reason to be doing that. -- Scott