Only look at immediate children for Signature
Only look at immediate children for Signature

By searching only for immediate children instead of any descendants, we avoid getting two Signatures found for a signed Response containing a signed Assertion.

According to the SAML 2.0 Assertion schema, the `<ds:Signature>` element must be a direct child of the `<Assertion>` element, so this should be a safe change.

Clever/saml2