How SAML works, and why XML signature wrapping keeps breaking it

How SAML works: the identity provider signs an XML assertion and hides the signature inside it. That is why XML signature wrapping bugs keep coming back.