@ckarlof can you confirm I should remove this? Is it also the case for the default FxA assertions generated by the auth-server?