the ds:Signature element is no longer part of the document written to disk, done through src/MetadataSource.php. Not sure why this was done, have to review the security audit document as it as mentioned in the comments there.

https://git.sr.ht/~fkooman/php-saml-sp/tree/main/item/src/MetadataSource.php#L256