Fix misleading comment with fingerprint hash weaker than a certificate verification
Fix misleading comment with fingerprint hash weaker than a certificate verification

The reasoning of a fingerprint hash weaker than providing a certificate like a CA is wrong. 

A X509 signature of a certificate always uses a Hash like SHA1, SHA256, etc, which is then signed. E.g. 

 openssl1.1 x509 -text -in sp-test.pem 

    Signature Algorithm: ecdsa-with-SHA256

So these are as vulnerable to collision attacks as fingeprints.

Depending on the implementation of the fingerprint, there are other for not using them. E.g. some implementation ignore other problem with a certificate like validity or missing EKUs.
onelogin/python3-saml,onelogin/python3-saml