I added some new possible resolutions, based on discussion during the Mar. 21 conference call. However, it is also important that data not be available to third parties, such as snoopers or untrusted intermediaries. One possible solution for implementors is to use secure channels between relying party and asserting party. Another is specifically encrypt the SAML data, either with a shared secret or with public keys. Each binding must include a description of how the confidentiality and integrity of SAML messages can be protected within that binding.
Deployments can choose the appropriate solution.
Confidentiality protection shall use XML Encryption when it is ready.