OpenSAML user discussion

["Scott Cantor" <>]

> I assumed he meant a binary security token that represents a signing key,
> for example an STR that lives in Assertion/Signature/KeyInfo or another
> Signature/KeyInfo in the Security header.

It's not the former, sender-vouches never includes anything like that. As
for the latter, you wouldn't normally sign the key you're signing with, and
I would assume the key would be inside the Signature's KeyInfo, not inside
an STR.

-- Scott