It doesn't have to store the entities; it's just trusted by some set of service providers to provide identity claims. Nothing in the definition says an IdP can't federate further.