Assurance

[Tom Scavo <>]

> I don't see anything that would apply to protecting private keys held
> by the IdP.

Thanks for checking.

> Are you specifically thinking about the keys associated
> with exchanging information with the IdP, or do you mean something
> like key escrow for private keys associated with personal
> certificates?

The former. Proper handling of the IdP's private signing key 
(https://spaces.internet2.edu/x/E43NAQ) is critically important in a 
federated scenario. I continue to be surprised/concerned that this is not 
explicitly addressed in the Identity Assurance Profile.

Tom