The current straw man 2 document does not have a use case scenario for exchanging data between security services that are previously unknown to each other. For example, a relying party may choose to trust assertions made by an asserting party based on the signatures on the AP's digital certificate, or through other means. The following use case scenario would illustrate using assertions from an unknown party. It would be difficult for the application service provider to maintain agreements with hundreds of such organizations in order to verify assertions made by those parties. Instead, it chooses to check the key of the asserting party to ensure that the asserting party is a 4-year university.
Student authenticates to university security system.
University provides authentication document to student application, including authentication event data and authorization attributes. Student application requests resource from application service provider. Request includes authentication document. Application service provider makes a trust decision about the authc and authz data, based on the key used to sign the assertion. It determines that the signing party is an accredited 4-year university, based on a signature on the key made by an accrediting organization.