title: Sign SAML Response with or without Assertion Signature?
body: <p>When signing a SAML Response that also has a signed Assertion, should I:</p>
  
  <p>A) Generate the Response signature without the Assertion signature. Then inject the Assertion signature after both signatures have been generated.</p>
  
  <p>B) Generate the Assertion signature and include it when generating the Response signature.</p>
  
  <p>C) Something else?</p>