Re: [security-services] Groups -sstc-saml-x509-authn-attrib-profile-draft-10-diff.pdf uploaded

> Agreed.  A separate metadata profile should address this issue, 
> correct?

Personally, just adding optional MAY or SHOULD language around use of metadata seems fine. The goal is to codify how people ought to use it, but it doesn't have to be phrased as MUST if people are using metadata now in an older way.

-- Scott