That's because its built in part on XMLDSig, a genius idea to sign active content that can redefine its own semantics as it's being signed/verified. It's a triumph of ideology over common sense.
NB I can absolutely see why canonicalization is required... just that it was the bit where I lost interest
And that was before you got into deliberately malicious content that actively subverts the signature process.