title: Using self-signed certificate for Saml 2 assertion
body: <p>I'm working on Idp side of a Saml 2 SSO and as IdP we are supposed to post an assertion to the SP and It will be IdP-initiated.
  There is a field in the assertion named x509certificate. 
  My first question is that is this field public key itself or public key signed by a CA (Certificate Authority)?
  And my second question is that if it is a public key signed by a CA then would it be safe to be self signed or better to be signed by a real CA?
  And my third question is that is it better we provide SP with Idp Metadata or it is more safe to have certificate in any assertion request or maybe both?
  Thank you</p>