[security-services] SubjectConfirmation

I haven't seen this issue being addressed:

line 1690-1699 of core-25:

According to current schema, the following is allowed:
<Subject>
	<NameIdentifier>...</NameIdentifier>
	<SubjectConfirmation>...</SubjectCondirmation>
</Subject>

How do we know which <SubjectConfirmation> it is: the optional one that is 
paired with NameIdentifier, or the one outside of the sequence?

Thanks,
Emily