HUMAN VERIFICATION REQUIRED ASVS 6.8.2 Signed assertions (when federated_identity is used)

The presence and integrity of digital signatures on authentication assertions (for example on JWTs or SAML assertions) are always validated, rejecting any assertions that are unsigned or have invalid signatures.