Decrypt assertion before signature validation. Handle SHA-256 fingerprints.

Because the decryption happens early, settings do not work. This is a
hack. The XML Security document creation should occur outside the
constructor if its going to raise on lack of an xmlsig node.