This building so much flexibility into protocols seems like a 90s holdover.
We are realizing that the more moving parts you have, the more edge cases you have, and the more attack surface area.
Do we sign the bytes of the document? No, we canonicalize it first? How do we canonicalize? Multiple ways. Do all documents with the same canonicalization have the same DOM? No. Which part of the document do we sign? Up to you.
Its a wonder there aren't more major saml breaches.
And then if you sign sibling documents, you essentially have most of the same problems you have with ensuring a zip file doesn’t have a malicious payload, because file cannonicalization is fraught with issues.
It took me a couple pages of don’ts to nail it down, and I missed a big one that I didn’t see until pretty late in the project.
Also, those specs all have a degree of interoperability, which is a pretty significant difference. Like many thunderbolt 3 docks can actually also just run when connected to usb-c w/ dp-alt mode, although they lose out on the thunderbolt extras of course. Something that seems to be missing here.