Cannot verify peer certificate when receiving HTTPArtifact

Hi,

When receiving a HTTP Artifact, I need to use a certificate which is signed with a private certificate authority.

I found a section of code in SAML2\SOAPClient::send method, which theoretically is there to do exactly what I need - load a private CA file to the context of the SoapClient, so that it could be used to verify the certificate: https://github.com/simplesamlphp/saml2/blob/v4.6.3/src/SAML2/SOAPClient.php#L85-L105

This code section depends on the $dstMetadata variable, which is the third parameter of the SOAPClient::send method, is supposed to be a SimpleSAML\Configuration, and is optional.

Unfortunatelly, the SAML2\HTTPArtifact object which uses SOAPClient::send when receiving the artifact, doesn't specify this third Configuration argument at all, leaving this $dstMetadata variable empty and causing the peer certificate verification to be skipped:
https://github.com/simplesamlphp/saml2/blob/v4.6.3/src/SAML2/HTTPArtifact.php#L149
which is by the way the only use of SAML2\SOAPClient::send method I've found in the simplesamlphp/saml2 package, which would make that verification section of the code never to be used.

Is it intentional? Is something forgotten? Wrongly removed? Is this third Configuration parameter of SOAPClient::send method used in some other package only?

Do you plan to add this possibility to SAML2\HTTPArtifact in any near future?

Is there any way I could currently use this feature to actually load a private CA file and perform the certificate verification against it?

Review SAML2/SOAPClient.php around the send method and SAML2/HTTPArtifact.php around line 149, focusing on how the optional destination Configuration is passed. Trace HTTPArtifact receipt through SOAPClient::send and determine the expected private CA verification behavior. Done means the HTTPArtifact path can use the configured CA for peer certificate verification, with coverage for that path.