This callback passed to verifyAssertion doesn't check err to see whether or not the assertion actually succeeded, which is why things were failing for me (something along the lines of "audience/domain mismatch").  I'll put some thoughts for what semantics we might want in my comments around the tests for signin.