Whatever is defined in the configuration is the default.

src/saml2/client_base.py

@@ -301,6 +301,9 @@ class Base(Entity):
         except KeyError:
             pass
 
+        if sign is None:
+            sign = self.authn_requests_signed
+
         if (sign and self.sec.cert_handler.generate_cert()) or \
                 client_crt is not None:
             with self.lock: