Scenario: Consider a huge and diverse federation of Identity (IDPs) and Service (SPs) providers. Since trust level is generally low, Identity providers are reluctant to give out any kind of personal identifiable information (PII).
Now there are some services requiring PII, the respective SPs follow some higher standards that are certifiable by a known (to the IDPs in question) central instance.
Question: Is it possible that the central instance hands out some certificate (working like a server certificate with respect to signature and revocability) telling this is a specially trusted SP and the SP can present that certificate to the IDP who verifies it and than issues PII? Can it be implemented using SAML?
Note: Simple having some non-certified attribute on the SP is clearly a non-starter: Once that attribute becomes known to a potentially rogue SP, they can just steal (i.e., copy) it and use it themselves.