In proxying scenarios, upstream proxies may add more elements to the chain
of AuthenticatingAuthorities. When multiple elements are present, the
one most recently added is at the end of the list (SAML core 3.4.1.5.1).
This is the IdP closest to us. Other proxies could be added at any time
after it, and this should not influence the outcome.

This may change ID's generated with the old code. However, I would consider
those ID's to be already buggy. But it makes sense to list this as a
potentially breaking change in the release notes.

Closes #2
Closes simplesamlphp/simplesamlphp#1431