The decryption and signature verification is the worst nightmare. Why? Because the spec signs the actual bytes of the XML, which means that if you change the order of two elements, even if everything else is exactly identical, the signature changes. Everything has to preserve the XML exactly as generated, down to the character set, or else the verification breaks.

Edit: I know the article talks about this, but my point is that his description of the round-trip instability isn't quite right. You can't change the bytes arbitrarily.