Also, God help you when it's time to swap out your IdP's signing certificate... almost no SPs/RPs support automatic metadata retrieval and updating, so a mad rush to do everything on a Saturday is par for the course. Some, but not most, IdPs support granular signing certificate config.