Just wondering, in SAML SSO, the SP can include its certificates in the SAML request, and the IdP can include its certificates in the SAML response/assertion, so they can ve