"Doesn't useful key discovery require that it be done over SSL? No SSL means that there might be a man in the middle and thus the key could be incorrect. Signing the XRDS file means that the key used to sign either needs to chain up to a root via PKI that you trust or that you fetch the key to verify the signature over SSL. And round and round we go."
- David Recordon