| Subject: | 2.0 spec requires certain resoponse fields to be signed, but Consumer doesn't enforce this. |
The 2.0 spec requires the following fields to be signed:
"op_endpoint", "return_to" "response_nonce" and "assoc_handle" MUST be
present and signed.
"claimed_id" and "identity" must be signed only if they are present in
the message.
Currently Consumer doesn't verify this and will accept a message where
none of the above are signed.