The problem with SAML et al is not Java or XML. The problem is the spec conflating transport protocol concerns with the content format concern. If you can clea

The problem with SAML et al is not Java or XML. The problem is the spec conflating transport protocol concerns with the content format concern. If you can cleanly separate the transport component's cryptography (making sure the content is secure and private) from the formatting and processing of the actual content it makes things a lot clearer.