Per-Entity Metadata Working Group

["Cantor, Scott" <>]

> *     IdP and SP administrators will need to do something to take
> advantage of per-entity metadata distribution.  Even assuming we don't ask
> them (or their institutions) to run the distribution layer, they still have
> significant work to do.

I would not agree that a few config changes is significant work. Getting 
people to do it is a hassle, but that's not because it's hard, it takes a 
couple of minutes to do the change. If you're thinking in terms of some kind 
of large scale testing activity by every site, we can't go into this with 
that expectation.

The most significant work would be if we change the signing key, but that's 
work "in theory" since in practice people don't carefully validate trust 
anchors just because they should.

> *     If we did ask them to run their part of the distribution layer, we 
> could
> provide them with an instrumented VM container.

Still a non-starter IMHO. What you'd have to do is force us to built it into 
the software, essentially.

-- Scott