So not completely clear on what the standard says. Had to add this to make it work with Shibboleth IdP.
Allow config file specification to be whole path and not just a module/file name.
If we don't want to verify the SSL certs then don't use them.
Status code can be once or twice removed :-)
This may not be needed, but I've encountered different names for the xmlsec binary on Windows machines. So just to be sure.