This post [0] persuaded me that I need multiple SAML IDP signing keys to prevent badly behaved third party apps from accepting every user authentication as an a

This post [0] persuaded me that I need multiple SAML IDP signing keys to prevent badly behaved third party apps from accepting every user authentication as an authorization. Keycloak supports this configuration, but can anyone comment on how reasonable this is from an ops standpoint? Is it difficult to configure this way? Is it harder to back up? [0] https://news.ycombinator.com/item?id=22739626 https://news.ycombinator.com/item?id=22739626