I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions.
In this use case, I hold the private key in my Service Provider, and we furnish the public key to the Identity Provider. For most customers using this mode of SAML2, they just accept the self-signed public key we provide.
To me it seems the trust relationship is between me (the SP operator) and the customer (the IdP operator) and a CA doesn't add anything to that trust relationship.
What am I missing about extra security provided by a signed certificate in this case?