> I don't understand how we can reliably process assertions
> that include local times and no timezone. Are you saying that
> the relying party for the assertion MUST assume that the time
> value is actually UTC even though the "Z" is omitted? That
> sounds very dangerous to me.
As far as I can tell, that's what "canonical representation" means, but
I'm with you, I don't like it, even if it means the schema gets more
complex as a result.
> Maybe I'm confused though?
It's just as likely me, but my action item was to try and read up on it,
and this is what I found to be the case.
-- Scott
