The spec is subjective. At least there is no reference about not having signatures on both message and URL parameters, when using HTTP-REDIRECT.

But Shib is kind of a RI, so better is stick with it.

Thanks.