@jedp - I'm confused by this. If the forceIssuer is the same as the issuer (and an allowed issuer), we call next, but if the forceIssuer is not the same as the issuer, we go on to check delegation? Does that make sense? If an RP requests forceIssuer for a specific domain and then that domain delegates off to another domain, does that break the contract with the RP?