If SP metadata indicates "want_assertions_signed", then verify that they are signed