This implies that SAML will have to require a key management protocol, just to support basic Web Single Signon. A simpler alternative is to use a pure reference and a hash. Use the hash as an identifier in the assertion. Use the unhashed value as the claim check. The actual URL or cookie will need to conatain some information about where to get the Assertion from or its domain or such.
Hashes are fast and efficient.
There will be no requirement for a key management protocol. Finally, it will help with the distributed logout problem. If claim checks contain assertion information, it will be tempting to use them by themselves and not retrieve the actual assertions. To implement distributed logout on a session, we need to be able to search out and destroy every copy of assertions bound to that session. If references are used, it will be easier for a small number of SAML servers to keep track of what Application Servers have a copy of any given assertion.