X509 Authn Attribute Profile erratum?

In 
the overview in Section 4 "Encrypted/Signed Mode" line 194, the 
profile specifies that the responding IdP MUST sign the 
<Response>.

 

In Section 4.2.1 
"<Response> Usage" line 250 and in Section 4.2.3 "Use of Digital 
Signatures" line 280 it specifies that the <Assertion> MUST be 
signed.

 

Which is 
it?

 

Ari 
Kermaier