Following is my understanding - A third party app redirects to a an OP for authentication. Once the authentication is complete the OP redirects back to the third party app.
It also sends back in query string a number of parameters and also sends back a signature. My question is how does the third party app verify the signature. As I understand it will need a shared key to do this, but I don't see that shared in the in the initial redirect to the OP?
Now assuming that a key was shared, then what is the use, as the communication can be sniffed, and the contents manipulated.