SAML: A Fractal of Bad Design

What a great title. I never quite understood why XML took over the world and got itself baked in to everything. I guess it kind of did everything well enough compared to whatever came before? Or because it was heavily used in Java-land?

Edit to add: This is also the only time I've seen JWT used in a security comparison and come out on top! (re: not including the signature in the payload)