allow encrypted as name id policy
namespace SubjectConfirmationData element and make fix notOnOrAfter value