In an app that's accessed through HTTPS only, is it enough to ensure the Assertions are signed?

I'm using the "WantAssertionsSigned" policy only and I'm wondering if it's secure or not