Potentially unsafe default impl for `getKeyInfo()` about xml-crypto HOT 2 CLOSED

I've added a comment in #401 to clear up the README in this case. I'm very much in favor of keeping to the spec, so having a clear README about how to handle the case where you'd like to deviate from the spec I think is the more appropriate action. This course also means that we won't have to take on a breaking change. Even adding a convenience method wouldn't be a breaking change as that would just extend the API surface.

I was even thinking about this convenience method and there really isn't a need for it since getCertFromKeyInfo() is publicly available, they can just call it themselves and perform whatever checks, including certificate revocation checks, they want. We can document that better if you think needed. Otherwise, I'm happy the way things are.

from xml-crypto.

@cjbarth - if we don't plan to act on this for now, I'll move this to discussions

from xml-crypto.