The scenarios you mention would all be a problem with SAML and would be with just about any SSO method. If someone has root access on a server or has acquired the private keys, the security of the system is significantly if not completely compromised.
When you are delegating authentication, any compromise in trust can invalidate part or all of the assurance process. If a private key has been compromised, no assertion made by the idP can be trusted.
That said, if an attacker gains root privilege on a server, you probably have much bigger problems to deal with anyway. In the case of the RSA SecurID compromise, a number of people have tried to minimize the impact and are saying it will not kill SecurID. However, these people are overlooking that the fact that these hackers had such extensive access to do what they did would make it difficult for RSA to prove that we can trust their authentication products.