https://github.com/perl-net-saml2/perl-Net-SAML2/blob/d08b1720c3e2613093beb3a48b9ef14edc61fefa/lib/Net/SAML2/IdP.pm#L124 Probably in new_from_xml as new_from_file calls this. We are not providing an option to validate that the Metadata XML is properly signed