I saw satisfy, but then couldn't see a way to make Cosign optional...
... because this is new, or I don't remember it. :-)
It is new in 1.7.0. It's from IIS Cosign, the U of M school of
business had a need for it. It seemed like such a nice idea (a way to
give the application control over cosign's "container" model) that we
ported it to Apache Cosign.
