Not checking any signature is completely insecure and we'd want to
go through great lenghts to avoid this. Just logging a warning does
not suffice, since will read logs when it doesn't work, but it does.

Given that the other signature verification options want_assertions_signed
and want_response_signed will overrule this setting, defaulting it to true
does not impact any configuration that has one of those settings. It does
however catch the situation where someone has disabled response signature
checking. This prevents that user from landing on an error about an
insecure config, and rather employs this reasonable fallback scenario.

…lient_base.py

Co-authored-by: Ivan Kanakarakis <[email protected]>