protected void validateAssertionSignature(final Signature signature, final SAML2MessageContext context,
                                              final SignatureTrustEngine engine) {
        var configContext = context.getConfigurationContext();
        val peerContext = context.getSAMLPeerEntityContext();

        if (signature != null) {
            val entityId = peerContext.getEntityId();
            validateSignature(signature, entityId, engine);
        } else {
            if (wantsAssertionsSigned(context)) {
                throw new SAMLSignatureRequiredException("Assertion must be explicitly signed");
            }
            if (!peerContext.isAuthenticated() && !configContext.getSAML2Configuration().isAllSignatureValidationDisabled()) {
                throw new SAMLSignatureRequiredException("Unauthenticated response contains an unsigned assertion");
            }
        }
    }
Validate assertion signature. If none is found and the SAML response did not have one and the SP requires
the assertions to be signed, the validation fails.

@param signature the signature
@param context   the context
@param engine    the engine
pac4j-saml/src/main/java/org/pac4j/saml/sso/impl/SAML2AuthnResponseValidator.java