Verifies the XML Signature (XML-DSig) in the inbound wsse:Security header. Beyond checking that the signature is cryptographically valid, this validates the signing certificate against the enclosing wsSecurity element's truststore, and confirms the signature actually covers every element listed in requiredReferences — the defense against XML Signature Wrapping attacks, where an attacker leaves a validly-signed but irrelevant fragment in the message while the element downstream logic actually reads is unsigned or swapped. Freshness of a wsu:Timestamp is only enforced when requiredReferences contains a TIMESTAMP entry; without one, a captured signed message stays replayable. Requiring a USERNAME_TOKEN entry likewise is what binds a usernameToken credential to this message rather than leaving it replayable on its own.
Accepted algorithms are fixed and deliberately stricter than what secure can be configured to produce: SHA-256 or better for both digest and signature, and canonicalization as the only permitted ds:Transform. A message using anything else — a SHA-1 downgrade, or a transform that digests a node-set other than the element its ds:Reference names — is answered with wsse:UnsupportedAlgorithm.
Tolerance, as an ISO-8601 duration, applied when checking a required TIMESTAMP reference's Created/Expires against the current time. Only relevant when requiredReferences includes a TIMESTAMP entry.
The elements that must be covered by the signature. Verification fails if any of these is not referenced by the signature, or if the referenced element is not the same element found by structural navigation (the defense against signature wrapping attacks).