Make signing of SAML requests optional

The majority of IdPs do not require this, so it makes setup substantially more difficult than necessary. You can signup for a free 30 day trial with Okta or OneLogin to verify (or I can send screenshots showing this is the case).

For a service provider (SP), failing to sign requests makes the whole process worthless. On the IdP side, it's less important. It is only necessary if the IdP wishes to verify that the request really comes from an SP it trusts. E.g. if the SP requests certain confidential attributes to be disclosed (that not all SPs should see), and possibly to encrypt those attributes in the response so that only this SP can read it.