I added another diagram for the eduGAIN trust mark issuance, with the specific checks that apply.
For the enrollment endpoint, the response is an Entity Statement, but to be specific, a Subordinate Statement, as returned by the fetch endpoint as well. Does it make sense to use POST instead of GET in this diagram?