Hello, and thank you for the security patch.

I have an integration working with 2.9.1 where I receive an EncryptedAssertion. After upgrading to 2.10.0 it fails in this new check as there's no Assertion in the response - only EncryptedAssertion.

Has the previous version been "working" without actually checking the signature and I'm somehow using the library wrong?