Read the KeyInfo element of a meta file's IDPSSODescriptor into a public key that can be used for signing. Tested for KeyInfo elements that contain an x509 certificate.

Self-signatures are only verified if first argument is True. The reason for this flag is that some IdPs (e.g. centrify) sign their certificates with external CAs. Verification against external cert needs to be done separately before calling this function.

If first argument validSince is Nothing, use cucrent system time.

We sometimes get XML documents that are underspecific about which credentials they are going to use later. As longs as all credentials are from the same authoritative source, it may be ok to ask for *any* of them to match a signature. So here is an or over verify and a non-empty list of SignCreds.

NB: The call to unsafePerformIO in this function is sound under the assumption that verifyIO has no effects in IO other than throwing SomeException (which are captured by try. Technically, it does have other effects, like opening temp files for capturing stderr (if any), but we do not care about those. The only thing we care about is that the conceptually pure function of validating a signature will either be called twice with the same arguments and return the same result value, or not be called a second time with the same arguments, in which case that same value will be used.

Try a list of creds against a document. If all fail, return a list of errors for each cert; if *any* succeed, return the empty list.

Make sure that root node node has ID attribute and sign it. This is similar to the more primitive generateSignature. Cons signature to the children list (left-most position).

Like signRoot, but insert signature at any given position in the children list. If the list is too short for this position, throw an error.