> backend onto the same ancient libxmlsec codebase

If anyone is looking for SAML bindings and is using java and wants to avoid libxmlsec, my employer has an open source set of bindings for processing SAML requests: https://github.com/FusionAuth/fusionauth-samlv2

It does depend on Jakarta XML: https://jakarta.ee/specifications/xml-binding/