InCommon metadata support

[Tom Poage <>]

Thank you both, Scott and Tom, for the clarification.

Right, there does seem to be no single answer. Use a self-signed certificate 
to get around the 100s of CAs problem, and Wrong Thing deployers do the 
equivalent of:

curl -k

and still don’t check the sig. Boo.

I sense there’s also not much middle ground (vs. dichotomy) to make it 
relatively easy for Right Thing deployers to do just that, and to present a 
semi-surmountable obstacle to Wrong Thing deployers to do, well, just that.

This does seem to make it clear to Wrong Thing deployers of their choice: 
“Oh, you want the insecure version of that?” OK, wishful thinking. :-)

https://mdq.incommon.org:<port>/insecure

Tom.