When using the new SetSPKeyStore function to set the keystore, RetrieveAssertionInfo is unable to decrypt a valid encrypted saml assertion. The reason for this is the getDecryptCert function does not consider using spKeyStoreOverride, it only looks at SPKeyStore which is now deprecated.

The call stack looks like the following:

sp.RetrieveAssertionInfo(samlData)
    sp.ValidateEncodedResponse(encodedResponse)
        sp.decryptAssertions(...)
            sp.getDecryptCert()     <----- fails here if sp.SPKeyStore == nil