lib/samlr/response.rb
def verify!
      if signature.missing? && assertion.signature.missing?
        raise Samlr::SignatureError.new("Neither response nor assertion signed with a certificate")
      end

      signature.verify! unless signature.missing?
      assertion.verify!

      true
    end
def verify!
      if signature.missing? && assertion.signature.missing?
        raise Samlr::SignatureError.new("Neither response nor assertion signed with a certificate")
      end

      signature.verify! unless signature.missing?
      assertion.verify!

      true
    end
The verification process assumes that all signatures are enveloped. Since this process
 is destructive the document needs to verify itself first, and then any signed assertions