Yes it needs to be for SAML1 and SAML2 tokens to resolve keys without wrapping them inside tokens first. .NET doesn't have and SecurityKey to SecurityKey matching so I have to write it.