The IdP confirms that you do have an account there, and sends back an XML signature, via the browser. As it’s an obvious potential problem for the user’s browser to be the one handling the ...