SAML signature wrapping tests at the signed-reference boundary

A SAML response can contain a cryptographically valid XML Signature while the application consumes an assertion the signature never protected. This is the practical danger behind signature wrapping. T