[OpenID] clarification on openid.signed contents / duplicates

[Bill Shupp]

Can openid.signed have duplicate entries?  I found this to be the case  
with an OP recently, and the library I'm using (php via PEAR) did not  
allow for this, so the signature checking would fail.  However, the  
JanRain php library does allow for this.

Section 4.1 of OpenID 2.0 specifies that Protocol Messages "MUST NOT  
contain multiple parameters with the same name.".  However, this is  
just KV form of the openid.signed items.  Is this still considered a  
protocol message, and therefor not allow duplicates?  It's not clear  
to me, so I thought I'd ping the list for clarification before leaving  
in the workaround I added to support this case.

Thanks,

Bill Shupp