At most that certificate is good for 24 hurs. The user has to get his assertion signed by the identity provider too, and it is possible to get them pre-signed

At most that certificate is good for 24 hurs. The user has to get his assertion signed by the identity provider too, and it is possible to get them pre-signed up to that same 24 hours. So the window of users is narrowed to the list of sites that queried the identity provider and the users who had an assertion signed within those 24 hours. Which is weakly anonymous for high-volume sites and no protection at all for low-volume cases. However, the kicker is the protocol doesn't protect against the identity provider setting the expiration to something like 5 minutes, effectively unmasking the client and the website by requiring them both to talk to identity provider within that 5 minute window.