allow signature external to the assertion

[chad3814]

• this should fix signature check fails if whole response is signed #57 and allows the signature to be embedded outside the assertion element #48; see them for comments

[jefff]

Thanks for the PR! Sorry for the delay in reviewing this.

As a minor change, can you flip the order of the two signature checks in the or so the current behavior is preserved in the default case? In practice, I don't think it actually matters, but it would make me a bit more confident in releasing this as a minor version bump.

[chad3814]

Sure, no problem

[jefff]

Thanks, lgtm!

[jefff]

Published as 1.5.0