I thought I heard this somewhere but can't remember where exactly and can't find a reference either: is it correct that Salesforce would NOT allow a self-signed cert to use with an external identity provider? I know self-signed certs are allowed for connected apps because I have used one myself.