Message Signature Validation

[Pivotal Issue 78632442][1]

[1]: https://www.pivotaltracker.com/n/projects/1163646/stories/78632442
Well that depends how much value you place in Postels law.
In practice at OpenConext we've seen that a single bad certData would flood the system with warnings for every request even when that entity wasn't even remotely involved in the SSO. That's why I had to implement a LazyProxy in EB to defer parsing / checking until use.
Though usage here might be completely different, I can't tell at this level of detail. At EB we get the entire federation configuration and we transform all of that into our own data model and into objects immediately.