One day I will write an essay on all of the incredibly stupid things XML DSig does, and that's not even touching the cryptography. It's peak enterprise software brain.

Someone should go deep on the mailing list and standards body horrors of WS-* and OASIS/XACML and all that crap