OpenSAML user discussion

While testing we found that the SignatureValidator.validate method indicated 
that a saml a signature was valid using an expired certificate. Is this 
appropriate behavior or should the validate method also validate the 
certificate?

Is there some other place that the certificate is validated? We have a very 
simple implementation and are not using a trust engine.

Its not a big deal as we've added code to check the validity of the 
certificate before validating the signature. I'm just wondering if this is a 
bug or by design?

Thanks.