diff --git a/docs/usage/examples.rst b/docs/usage/examples.rst
index 711216ab..8d4f63df 100644
--- a/docs/usage/examples.rst
+++ b/docs/usage/examples.rst
@@ -223,6 +223,25 @@ the Signature object.
     - publish: /tmp/idp.xml
     - stats
 
+If the PKCS#11 library exposes several initialized tokens, select one explicitly
+by its token label and, when labels are duplicated, its serial number. For
+example, a Luna HA client configured by ``/etc/Chrystoki.conf`` can use:
+
+.. code-block:: yaml
+
+    - sign:
+        key: pkcs11:///usr/lib/libCryptoki2_64.so/sctest2
+        token_label: sc_ha
+        token_serial: "11429933786539"
+        cert: /etc/credentials/sc-test-md-signer.crt
+
+``token_serial`` is optional when ``token_label`` uniquely identifies the
+token. Alternatively, use ``slot_id`` or the historical ``:slot`` URI suffix,
+for example ``pkcs11:///usr/lib/libCryptoki2_64.so:17/sctest2``. Do not combine
+a slot selector with ``token_label`` or ``token_serial``. The token label selects
+the HSM token; the final URI component (``sctest2`` above) selects the key object
+within that token.
+
 Running this example requires some preparation. Run the 'p11setup.sh' script in the examples directory.
 This results in a SoftHSM token being setup with the PIN 'secret1' and SO_PIN 'secret2'. Now run pyFF (assuming
 you are using a unix-like environment).
@@ -231,4 +250,3 @@ you are using a unix-like environment).
 
     # env PYKCS11PIN=secret1 SOFTHSM_CONF=softhsm.conf pyff --loglevel=DEBUG p11.fd
 
-
diff --git a/pyproject.toml b/pyproject.toml
index 13f1396b..b0dd08b0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,16 +19,16 @@ dependencies = [
     "accept-types>=0.4.1",
     "apscheduler==3.6.3",
     "cachetools>=5.5.2",
-    "eval-type-backport>=0.2.2 ; python_full_version == '3.9.*'",
+    "cryptography>=42",
     "gunicorn==25.0.3 ; python_full_version >= '3.10'",
     "gunicorn>=23.0.0",
-    "lxml>=4.1.1",
     "mako>=1.3.10",
     "pyconfig>=3.2.3,<3.3.0",
     "pydantic>=2.8",
     "pyramid>=2.0.2",
     "pytz>=2025.2",
-    "pyxmlsecurity>=1.0.0",
+    "pyuppsala>=0.11.0",
+    "pybergshamra>=0.9.0",
     "pyyaml>=3.10",
     "redis>=5.3.0",
     "redis-collections>=0.13.0",
diff --git a/src/pyff/api.py b/src/pyff/api.py
index 342c4877..4eb751cd 100644
--- a/src/pyff/api.py
+++ b/src/pyff/api.py
@@ -11,11 +11,11 @@
 import requests
 from accept_types import AcceptableType
 from cachetools import TTLCache
-from lxml import etree
 from pyramid.config import Configurator
 from pyramid.events import NewRequest
 from pyramid.request import Request
 from pyramid.response import Response
+from pyuppsala import etree
 
 from pyff import __version__
 from pyff.constants import config
diff --git a/src/pyff/builtins.py b/src/pyff/builtins.py
index 89b623fb..6d59512d 100644
--- a/src/pyff/builtins.py
+++ b/src/pyff/builtins.py
@@ -10,6 +10,7 @@
 import os
 import re
 import sys
+import threading
 import traceback
 from copy import deepcopy
 from datetime import datetime
@@ -17,9 +18,9 @@
 from typing import Optional
 from urllib.parse import quote_plus, urlparse
 
-import xmlsec
-from lxml import etree
-from lxml.etree import DocumentInvalid
+import pybergshamra
+from pyuppsala import etree
+from pyuppsala.etree import DocumentInvalid
 from str2bool import str2bool
 
 from pyff.constants import NS
@@ -43,10 +44,13 @@
     sort_entities,
 )
 from pyff.utils import (
+    cert_dict,
+    cert_info,
     datetime2iso,
     dumptree,
     duration2timedelta,
     hash_id,
+    is_document_root,
     iso2datetime,
     parse_xml,
     root,
@@ -63,6 +67,14 @@
 FILESPEC_REGEX = r'([^ \t\n\r\f\v]+)\s+as\s+([^ \t\n\r\f\v]+)'
 log = get_log(__name__)
 
+# PKCS#11 providers own the dynamically loaded vendor module. Keep them alive
+# for the worker process lifetime: some modules (including Luna) start native
+# background threads that outlive a provider object, so unloading and loading
+# the module again can leave those threads executing unmapped code. Sessions
+# remain short-lived and are opened separately for each signing operation.
+_pkcs11_provider_cache = {}
+_pkcs11_provider_cache_lock = threading.Lock()
+
 
 @pipe
 def dump(req: Plumbing.Request, *opts):
@@ -431,7 +443,7 @@ def info(req: Plumbing.Request, *opts):
     if req.t is None:
         raise PipeException("Your pipeline is missing a select statement.")
 
-    for e in req.t.xpath("//md:EntityDescriptor", namespaces=NS, smart_strings=False):
+    for e in iter_entities(req.t):
         print(e.get('entityID'))
     return req.t
 
@@ -707,7 +719,16 @@ def load(req: Plumbing.Request, *opts):
         req.md.rm.add_child(url, child_opts)
 
     log.debug("Refreshing all resources")
-    req.md.rm.reload(fail_on_error=bool(_opts['fail_on_error']))
+    req.md.rm.reload(
+        fail_on_error=bool(_opts['fail_on_error']),
+        max_workers=int(_opts['max_workers']),
+    )
+
+    # Resource trees are only an intermediate representation for loading and
+    # watcher callbacks. The store has its own entity copies after reload; keep
+    # the resource graph/metadata but release large parsed source documents.
+    for resource in req.md.rm.walk():
+        resource.t = None
 
 
 def _select_args(req):
@@ -1109,6 +1130,102 @@ def _discojson_sp_attr(req, *opts):
     return json.dumps(res)
 
 
+def _parse_pkcs11_key_uri(key_uri: str) -> tuple[str, str, str, Optional[int]]:
+    """Parse pyFF's historical PKCS#11 key URI syntax."""
+    if not key_uri.startswith("pkcs11://"):
+        raise PipeException(f"Malformed pkcs11 uri: {key_uri}")
+
+    module_and_slot, separator, label_and_query = key_uri[len("pkcs11://"):].rpartition('/')
+    if not separator or not module_and_slot or not label_and_query:
+        raise PipeException(f"Malformed pkcs11 uri (missing module path or object label): {key_uri}")
+
+    label, _, query = label_and_query.partition('?')
+    if not label:
+        raise PipeException(f"Malformed pkcs11 uri (missing object label): {key_uri}")
+
+    module_path = module_and_slot
+    uri_slot_id = None
+    path_without_slot, colon, slot_text = module_and_slot.rpartition(':')
+    if colon and re.fullmatch(r"-?\d+", slot_text):
+        try:
+            uri_slot_id = int(slot_text)
+        except ValueError as ex:
+            raise PipeException(f"Invalid PKCS#11 slot ID {slot_text!r}") from ex
+        if uri_slot_id < 0:
+            raise PipeException(f"Invalid PKCS#11 slot ID {slot_text!r}")
+        module_path = path_without_slot
+
+    pin_spec = "env:PYKCS11PIN"
+    if query:
+        for param in query.split('&'):
+            key, _, value = param.partition('=')
+            if key == 'pin':
+                pin_spec = value
+
+    return module_path, label, pin_spec, uri_slot_id
+
+
+def _select_pkcs11_provider(
+    module_path: str,
+    *,
+    uri_slot_id: Optional[int] = None,
+    slot_id=None,
+    token_label=None,
+    token_serial=None,
+):
+    """Get a process-cached provider using exactly one token selector."""
+    configured_slot_id = None
+    if slot_id is not None:
+        if isinstance(slot_id, bool):
+            raise PipeException(f"Invalid PKCS#11 slot ID {slot_id!r}")
+        try:
+            configured_slot_id = int(slot_id)
+        except (TypeError, ValueError) as ex:
+            raise PipeException(f"Invalid PKCS#11 slot ID {slot_id!r}") from ex
+        if configured_slot_id < 0:
+            raise PipeException(f"Invalid PKCS#11 slot ID {slot_id!r}")
+
+    if uri_slot_id is not None and configured_slot_id is not None and uri_slot_id != configured_slot_id:
+        raise PipeException("Conflicting PKCS#11 slot IDs in key URI and sign configuration")
+
+    effective_slot_id = configured_slot_id if configured_slot_id is not None else uri_slot_id
+    if token_serial is not None and token_label is None:
+        raise PipeException("PKCS#11 token_serial requires token_label")
+    if effective_slot_id is not None and (token_label is not None or token_serial is not None):
+        raise PipeException("PKCS#11 slot_id cannot be combined with token_label or token_serial")
+
+    normalized_token_label = None if token_label is None else str(token_label)
+    normalized_token_serial = None if token_serial is None else str(token_serial)
+    cache_key = (
+        os.path.realpath(module_path),
+        effective_slot_id,
+        normalized_token_label,
+        normalized_token_serial,
+    )
+
+    # Hold the lock through construction. functools.lru_cache and a
+    # check-then-create sequence can both invoke the constructor more than once
+    # during concurrent first access, which is precisely what vendor modules
+    # with process-global initialization cannot safely tolerate.
+    with _pkcs11_provider_cache_lock:
+        if cache_key in _pkcs11_provider_cache:
+            return _pkcs11_provider_cache[cache_key]
+
+        if normalized_token_label is not None:
+            provider = pybergshamra.Pkcs11Provider.with_token(
+                module_path,
+                normalized_token_label,
+                token_serial=normalized_token_serial,
+            )
+        elif effective_slot_id is not None:
+            provider = pybergshamra.Pkcs11Provider.with_slot_id(module_path, effective_slot_id)
+        else:
+            provider = pybergshamra.Pkcs11Provider(module_path)
+
+        _pkcs11_provider_cache[cache_key] = provider
+        return provider
+
+
 @pipe
 def sign(req: Plumbing.Request, *_opts):
     """
@@ -1124,11 +1241,15 @@ def sign(req: Plumbing.Request, *_opts):
     The 'cert' argument may be empty in which case the cert is looked up using the PKCS#11 token, or may point
     to a file containing a PEM-encoded X.509 certificate.
 
+    When several initialized tokens are visible, select one with ``token_label`` and optional ``token_serial``,
+    or with ``slot_id``. Token selection requires pybergshamra 0.8.1 or newer. The slot may alternatively be
+    supplied using the historical ``:slot`` suffix in the key URI. Slot and token selectors are mutually exclusive.
+
     **PKCS11 URIs**
 
     A pkcs11 URI has the form
 
-    .. code-block:: xml
+    .. code-block:: text
 
         pkcs11://<absolute path to SO/DLL>[:slot]/<object label>[?pin=<pin>]
 
@@ -1141,9 +1262,13 @@ def sign(req: Plumbing.Request, *_opts):
     .. code-block:: yaml
 
         - sign:
-            key: pkcs11:///usr/lib/libsofthsm.so/signer
+            key: pkcs11:///usr/lib/libCryptoki2_64.so/sctest2
+            token_label: sc_ha
+            token_serial: "11429933786539" # optional when the label is unique
+            cert: /etc/credentials/sc-test-md-signer.crt
 
-    This would sign the document using the key with label 'signer' in slot 0 of the /usr/lib/libsofthsm.so module.
+    This signs with the key-object label ``sctest2`` on the token labelled ``sc_ha``. The PKCS#11 client library
+    still reads vendor connectivity and HA settings from its normal configuration, such as ``/etc/Chrystoki.conf``.
     Note that you may need to run pyff with env PYKCS11PIN=<pin> .... for this to work. Consult the documentation
     of your PKCS#11 module to find out about any other configuration you may need.
 
@@ -1167,16 +1292,87 @@ def sign(req: Plumbing.Request, *_opts):
 
     if key_file is None:
         raise PipeException("Missing key argument for sign pipe")
+    if not isinstance(key_file, str):
+        raise PipeException("The sign pipe key argument must be a string")
 
     if cert_file is None:
         log.info("Attempting to extract certificate from token...")
 
-    opts = dict()
+    # Build the signing context. The reference id (if any) comes from the @ID
+    # attribute on the document root; pybergshamra already treats "ID" as a
+    # default id attribute, so we must NOT call ctx.add_id_attr("ID").
     relt = root(req.t)
     idattr = relt.get('ID')
-    if idattr:
-        opts['reference_uri'] = f'#{idattr}'
-    xmlsec.sign(req.t, key_file, cert_file, **opts)
+
+    # Read the certificate (if provided) as PEM text to embed in X509Data.
+    cert_pem = None
+    if cert_file is not None:
+        with open(cert_file) as fd:
+            cert_pem = fd.read()
+
+    mgr = pybergshamra.KeysManager()
+    ctx = pybergshamra.DsigContext(mgr)
+
+    is_pkcs11_key = key_file.startswith("pkcs11:")
+    if is_pkcs11_key:
+        # HSM signing via PKCS#11. The URI form is:
+        #   pkcs11://<module path>[:slot]/<label>[?pin=<pin>]
+        # where pin may be "env:VARNAME" (default env:PYKCS11PIN).
+        module_path, label, pin_spec, uri_slot_id = _parse_pkcs11_key_uri(key_file)
+        if pin_spec.startswith("env:"):
+            env_var = pin_spec[len("env:"):]
+            pin = os.environ.get(env_var)
+            if pin is None:
+                raise PipeException(f"PKCS#11 pin environment variable {env_var} is not set")
+        else:
+            pin = pin_spec
+
+        provider = _select_pkcs11_provider(
+            module_path,
+            uri_slot_id=uri_slot_id,
+            slot_id=req.args.get('slot_id'),
+            token_label=req.args.get('token_label'),
+            token_serial=req.args.get('token_serial'),
+        )
+        session = provider.open_session(pin)
+        signer = pybergshamra.Pkcs11Signer(session, label, pybergshamra.Algorithm.RSA_SHA256)
+        ctx.set_hsm_signer(signer)
+    else:
+        # On-disk private key path.
+        key = pybergshamra.load_key_file(key_file)
+        mgr.add_key(key)
+
+    if not is_pkcs11_key and is_document_root(relt):
+        # Sign the working tree in place through the shared native DOM
+        # (pyuppsala document handle). This avoids serializing the whole
+        # aggregate, the signer's internal re-parses, and the reparse of the
+        # signed result -- downstream pipes keep the very same tree, with the
+        # <ds:Signature> inserted as the root's first child.
+        #
+        # PKCS#11 signing deliberately uses the owned-string path below. In
+        # production, mutating a live pyuppsala aggregate through the native
+        # document capsule while a vendor PKCS#11 module signs has caused
+        # worker SIGSEGVs and partially serialized aggregates. Keeping the HSM
+        # operation on an owned document avoids that unsafe integration
+        # boundary while preserving the native fast path for software keys.
+        #
+        # Only valid when ``relt`` is the document root. After ``first`` (an
+        # MDQ single-entity request) the working document is an
+        # EntityDescriptor that is still a child of the loaded aggregate; the
+        # native document would then be the whole aggregate and the signature
+        # would land on the discarded EntitiesDescriptor, leaving the emitted
+        # entity unsigned.
+        doc = etree.native_document(relt)
+        pybergshamra.sign_enveloped_document(ctx, doc, reference_id=idattr, cert_pem=cert_pem)
+        req.t = relt
+    else:
+        # PKCS11 signing, or a subtree of a larger document (small, so the
+        # string round trip is cheap): serialize the working document, build
+        # the enveloped signature, sign, and reparse so downstream pipes see a
+        # standalone pyuppsala element.
+        xml = etree.tostring(relt, encoding='unicode')
+        signed = pybergshamra.sign_enveloped(ctx, xml, reference_id=idattr, cert_pem=cert_pem)
+        req.t = root(etree.fromstring(signed))
 
     return req.t
 
@@ -1207,13 +1403,17 @@ def stats(req: Plumbing.Request, *opts):
         raise PipeException("Unable to call stats on non-XML")
 
     if req.t is not None:
-        print("selected:       {:d}".format(len(req.t.xpath("//md:EntityDescriptor", namespaces=NS))))
-        print(
-            "          idps: {:d}".format(len(req.t.xpath("//md:EntityDescriptor[md:IDPSSODescriptor]", namespaces=NS)))
-        )
-        print(
-            "           sps: {:d}".format(len(req.t.xpath("//md:EntityDescriptor[md:SPSSODescriptor]", namespaces=NS)))
-        )
+        idp_descriptor = "{{{}}}IDPSSODescriptor".format(NS['md'])
+        sp_descriptor = "{{{}}}SPSSODescriptor".format(NS['md'])
+        # Native subtree counts avoid creating a Python proxy per entity. Role
+        # descriptor counts equal entities-with-role except for the rare entity
+        # carrying two same-type descriptors.
+        selected = req.t.fast_count("{{{}}}EntityDescriptor".format(NS['md']))
+        idps = req.t.fast_count(idp_descriptor)
+        sps = req.t.fast_count(sp_descriptor)
+        print("selected:       {:d}".format(selected))
+        print("          idps: {:d}".format(idps))
+        print("           sps: {:d}".format(sps))
     print("---")
     return req.t
 
@@ -1428,17 +1628,23 @@ def check_xml_namespaces(req: Plumbing.Request, *opts):
     if req.t is None:
         raise PipeException("Your pipeline is missing a select statement.")
 
-    def _verify(elt):
-        if isinstance(elt.tag, str):
-            for _prefix, uri in list(elt.nsmap.items()):
-                if not uri.startswith('urn:'):
-                    u = urlparse(uri)
-                    if u.scheme not in ('http', 'https'):
-                        raise MetadataException(
-                            f"Namespace URIs must be be http(s) URIs ('{uri}' declared on {elt.tag})"
-                        )
+    # The check's intent is O(distinct namespace URIs) (~5 in real metadata), but a naive
+    # per-element walk reads the full in-scope nsmap on every element, so the same handful of
+    # root-inherited namespaces get urlparse-d tens of thousands of times (165k urlparse calls on
+    # the SWAMID corpus). Dedupe: validate each distinct URI exactly once.
+    seen = set()
+    for elt in root(req.t).iter():
+        if not isinstance(elt.tag, str):
+            continue
+        for _prefix, uri in elt.nsmap.items():
+            if uri in seen:
+                continue
+            seen.add(uri)
+            if not uri.startswith('urn:') and urlparse(uri).scheme not in ('http', 'https'):
+                raise MetadataException(
+                    f"Namespace URIs must be http(s) URIs ('{uri}' declared on {elt.tag})"
+                )
 
-    with_tree(root(req.t), _verify)
     return req.t
 
 
@@ -1508,11 +1714,17 @@ def certreport(req: Plumbing.Request, *opts):
     error_bits = int(req.args.get('error_bits', "1024"))
     warning_bits = int(req.args.get('warning_bits', "2048"))
 
+    # One native pass: iterate entities directly and walk each (small) entity
+    # subtree for its certificates. The previous per-entity document-wide
+    # xpath (`md:EntityDescriptor[@entityID=...]//ds:X509Certificate`) was
+    # O(entities * document), and because annotate_entity mutates the tree
+    # between evaluations every xpath re-built the document's XPath indexes --
+    # unusably slow at eduGAIN scale (~10k entities).
+    x509_tag = "{{{}}}X509Certificate".format(NS['ds'])
     seen: dict[str, bool] = {}
-    for eid in req.t.xpath("//md:EntityDescriptor/@entityID", namespaces=NS, smart_strings=False):
-        for cd in req.t.xpath(
-            f"md:EntityDescriptor[@entityID='{eid}']//ds:X509Certificate", namespaces=NS, smart_strings=False
-        ):
+    for entity_elt in iter_entities(req.t):
+        eid = entity_elt.get('entityID')
+        for cd in entity_elt.iter(x509_tag):
             try:
                 cert_pem = cd.text
                 cert_der = base64.b64decode(cert_pem)
@@ -1521,46 +1733,53 @@ def certreport(req: Plumbing.Request, *opts):
                 fp = m.hexdigest()
                 if fp not in seen:
                     seen[fp] = True
-                    entity_elt = cd.getparent().getparent().getparent().getparent().getparent()
-                    cdict = xmlsec.utils.b642cert(cert_pem)
-                    keysize = cdict['modulus'].bit_length()
-                    cert = cdict['cert']
-                    if keysize < error_bits:
+                    # cert_info replaces xmlsec.utils.b642cert and exposes the
+                    # same fields the report needs: keysize (bits), subject, and
+                    # not_after (a datetime instead of the old raw string).
+                    cert = cert_info(cert_pem)
+                    subject = cert.subject
+                    keysize = cert.keysize
+                    if keysize is not None and keysize < error_bits:
                         annotate_entity(
                             entity_elt,
                             "certificate-error",
                             "keysize too small",
-                            f"{cert.getSubject()} has keysize of {keysize} bits (less than {error_bits})",
+                            f"{subject} has keysize of {keysize} bits (less than {error_bits})",
                         )
                         log.error(f"{eid} has keysize of {keysize}")
-                    elif keysize < warning_bits:
+                    elif keysize is not None and keysize < warning_bits:
                         annotate_entity(
                             entity_elt,
                             "certificate-warning",
                             "keysize small",
-                            f"{cert.getSubject()} has keysize of {keysize} bits (less than {warning_bits})",
+                            f"{subject} has keysize of {keysize} bits (less than {warning_bits})",
                         )
                         log.warning(f"{eid} has keysize of {keysize}")
 
-                    notafter = cert.getNotAfter()
+                    notafter = cert.not_after
                     if notafter is None:
                         annotate_entity(
                             entity_elt,
                             "certificate-error",
                             "certificate has no expiration time",
-                            f"{cert.getSubject()} has no expiration time",
+                            f"{subject} has no expiration time",
                         )
                     else:
                         try:
-                            et = datetime.strptime(f"{notafter}", "%y%m%d%H%M%SZ")
-                            now = datetime.now()
-                            dt = et - now
+                            # Compare against a "now" with matching awareness:
+                            # cryptography's not_valid_after_utc is tz-aware UTC,
+                            # while the deprecated not_valid_after is naive.
+                            if notafter.tzinfo is not None:
+                                now = utc_now()
+                            else:
+                                now = datetime.now()
+                            dt = notafter - now
                             if total_seconds(dt) < error_seconds:
                                 annotate_entity(
                                     entity_elt,
                                     "certificate-error",
                                     "certificate has expired",
-                                    f"{cert.getSubject()} expired {-dt} ago",
+                                    f"{subject} expired {-dt} ago",
                                 )
                                 log.error(f"{eid} expired {-dt} ago")
                             elif total_seconds(dt) < warning_seconds:
@@ -1568,15 +1787,15 @@ def certreport(req: Plumbing.Request, *opts):
                                     entity_elt,
                                     "certificate-warning",
                                     "certificate about to expire",
-                                    f"{cert.getSubject()} expires in {dt}",
+                                    f"{subject} expires in {dt}",
                                 )
                                 log.warning(f"{eid} expires in {dt}")
-                        except ValueError:
+                        except (ValueError, TypeError):
                             annotate_entity(
                                 entity_elt,
                                 "certificate-error",
                                 "certificate has unknown expiration time",
-                                f"{cert.getSubject()} unknown expiration time {notafter}",
+                                f"{subject} unknown expiration time {notafter}",
                             )
 
                     req.store.update(entity_elt)
@@ -1655,7 +1874,7 @@ def signcerts(req: Plumbing.Request, *opts):
     if req.t is None:
         raise PipeException("Your pipeline is missing a select statement.")
 
-    for fp, _pem in list(xmlsec.crypto.CertDict(req.t).items()):
+    for fp, _pem in list(cert_dict(req.t).items()):
         log.info(f"found signing cert with fingerprint {fp}")
     return req.t
 
diff --git a/src/pyff/constants.py b/src/pyff/constants.py
index acdc9063..8717cd78 100644
--- a/src/pyff/constants.py
+++ b/src/pyff/constants.py
@@ -348,6 +348,14 @@ class Config:
         "worker_pool_size", default=1, cmdline=['pyffd'], typeconv=as_int, info="how many gunicorn workers to run"
     )
 
+    use_native_fetcher = S(
+        "use_native_fetcher",
+        default=False,
+        typeconv=as_bool,
+        info="fetch http(s) metadata with pyuppsala's native (Rust, GIL-free) batch fetcher instead of requests; "
+        "bypasses the requests_cache body cache",
+    )
+
     threads = S("threads", default=10, cmdline=['pyffd'], typeconv=as_int, info="how many gunicorn threads to run")
 
     store_class = S("store_class", default="pyff.store:MemoryStore", info="the <pyff.store:Store> implementation")
diff --git a/src/pyff/parse.py b/src/pyff/parse.py
index f182dc8c..deb6d045 100644
--- a/src/pyff/parse.py
+++ b/src/pyff/parse.py
@@ -5,12 +5,13 @@
 from urllib.parse import quote as urlescape
 
 from pydantic import BaseModel, Field
-from xmlsec.crypto import CertDict
 
 from pyff.constants import NS
 from pyff.logs import get_log
 from pyff.resource import Resource, ResourceInfo
-from pyff.utils import find_matching_files, parse_xml, root, unicode_stream, utc_now
+
+# cert_dict replaces xmlsec.crypto.CertDict (fingerprint -> cert mapping).
+from pyff.utils import cert_dict, find_matching_files, parse_xml, root, unicode_stream, utc_now
 
 __author__ = 'leifj'
 
@@ -118,7 +119,7 @@ def parse(self, resource: Resource, content: str) -> ParserInfo:
         for xrd in t.iter("{{{}}}XRD".format(NS['xrd'])):
             for link in xrd.findall(".//{{{}}}Link[@rel='{}']".format(NS['xrd'], NS['md'])):
                 link_href = link.get("href")
-                certs = CertDict(link)
+                certs = cert_dict(link)
                 fingerprints = list(certs.keys())
                 fp = None
                 if len(fingerprints) > 0:
diff --git a/src/pyff/pipes.py b/src/pyff/pipes.py
index f15f7abb..534cb83c 100644
--- a/src/pyff/pipes.py
+++ b/src/pyff/pipes.py
@@ -13,7 +13,7 @@
 
 import yaml
 from apscheduler.schedulers.background import BackgroundScheduler
-from lxml.etree import Element, ElementTree
+from pyuppsala.etree import Element, ElementTree
 
 from pyff.exceptions import PyffException
 from pyff.logs import get_log
diff --git a/src/pyff/resource.py b/src/pyff/resource.py
index 4d0d1177..98135160 100644
--- a/src/pyff/resource.py
+++ b/src/pyff/resource.py
@@ -10,6 +10,7 @@
 import traceback
 from collections import defaultdict, deque
 from collections.abc import Iterable
+from concurrent.futures import ThreadPoolExecutor
 from datetime import datetime
 from enum import Enum
 from threading import Condition, Lock
@@ -17,14 +18,24 @@
 from urllib.parse import quote as urlescape
 
 import requests
-from lxml.etree import ElementTree
 from pydantic import BaseModel, ConfigDict, Field
+from pyuppsala.etree import ElementTree
 from requests.adapters import Response
 
 from pyff.constants import config
 from pyff.exceptions import ResourceException
 from pyff.fetch import make_fetcher
 from pyff.logs import get_log
+
+# Native (Rust, GIL-free) batch fetcher, used by Resource.reload when
+# config.use_native_fetcher is on. Optional: pyuppsala may be built without
+# its "net" feature, in which case the flag silently falls back to requests.
+try:
+    from pyuppsala import fetch_many as _native_fetch_many
+except ImportError:
+    _native_fetch_many = None
+
+from pyff import __version__ as _pyff_version
 from pyff.utils import (
     Watchable,
     hex_digest,
@@ -157,6 +168,40 @@ def i_handle(self, t: Resource, url=None, response=None, exception=None, last_fe
             t.info.exception = ex
 
 
+class _CIHeaders(dict):
+    """Response-header dict with case-insensitive ``get`` (the native fetcher
+    lowercases header names; callers ask for e.g. ``'ETag'`` like requests)."""
+
+    def get(self, key, default=None):
+        return super().get(key.lower(), default)
+
+
+class _NativeResponse:
+    """Minimal ``requests.Response`` stand-in over a pyuppsala ``FetchResult``,
+    exposing exactly the attributes ``Resource.load_resource`` reads."""
+
+    __slots__ = ('status_code', 'reason', 'headers', 'encoding', '_body')
+
+    def __init__(self, fr):
+        self.status_code = int(fr.status)
+        self.reason = fr.reason
+        self.headers = _CIHeaders(fr.headers)
+        content_type = self.headers.get('Content-Type', '')
+        self.encoding = None
+        if 'charset=' in content_type:
+            self.encoding = content_type.split('charset=')[-1].split(';')[0].strip() or None
+        self._body = fr.body
+
+    @property
+    def ok(self):
+        # Mirror requests.Response.ok (anything below 400).
+        return self.status_code < 400
+
+    @property
+    def text(self):
+        return self._body.decode(self.encoding or 'utf-8', 'replace')
+
+
 class ResourceOpts(BaseModel):
     alias: str | None = Field(None, alias='as')  # TODO: Rename to 'name'?
     # a certificate (file) or a SHA1 fingerprint to use for signature verification
@@ -285,21 +330,147 @@ def __str__(self):
             self.url if self.url is not None else "(root)", self.expire_time
         ) + ",".join([f"{k}={v}" for k, v in sorted(list(self.opts.model_dump().items()))])
 
-    def reload(self, fail_on_error=False):
+    def reload(self, fail_on_error=False, max_workers=None):
+        """Fetch and parse this resource tree, including discovered children.
+
+        The non-strict path runs ``r.parse(url_get)`` for every resource on a
+        ``ThreadPoolExecutor`` with a dynamic frontier: children discovered by
+        a parse (e.g. per-file resources from a ``dir://`` source, or MDQ
+        sub-resources) are submitted as soon as their parent finishes. Fetching
+        is I/O-bound and pyuppsala releases the GIL during parse/validate, so
+        ``max_workers`` threads genuinely overlap network transfers with
+        multi-core XML parsing (the old single Fetcher master thread parsed
+        every response serially).
+
+        :param fail_on_error: when True, fetch+parse serially and let the
+            first exception propagate (aborts the pipeline).
+        :param max_workers: thread count for the parallel path; defaults to
+            ``config.worker_pool_size``.
+        """
+        if max_workers is None:
+            max_workers = config.worker_pool_size
+        max_workers = max(1, int(max_workers or 1))
         with non_blocking_lock(self.lock):
             if fail_on_error:
                 for r in self.walk():
                     r.parse(url_get)
             else:
-                rp = ResourceHandler(name="Metadata")
-                rp.schedule(self.children)
-                try:
-                    rp.done.acquire()
-                    rp.done.wait()
-                finally:
-                    rp.done.release()
-                rp.fetcher.stop()
-                rp.fetcher.join()
+                # One parse per distinct URL, matching the old ResourceHandler
+                # dedupe (its pending dict was keyed by URL).
+                seen: set[str] = set()
+
+                # Flag-gated native batch fetch: each frontier round's http(s)
+                # URLs are fetched in ONE pyuppsala.fetch_many call (Rust
+                # threads, GIL released for the whole batch) and served to
+                # parse() through a requests-compatible shim. Fetch failures
+                # simply stay out of the map so parse() falls back to url_get,
+                # keeping requests' retry/local-backup error semantics.
+                use_native = bool(config.use_native_fetcher) and _native_fetch_many is not None
+                prefetched: dict[str, _NativeResponse] = {}
+
+                def prefetch(resources: Iterable[Resource]) -> None:
+                    if not use_native:
+                        return
+                    batch = [
+                        r
+                        for r in resources
+                        if r.url
+                        and r.url.startswith(('http://', 'https://'))
+                        and r.url not in seen
+                        and r.url not in prefetched
+                    ]
+                    if not batch:
+                        return
+                    # verify_tls is per-resource; batch per flag value so one
+                    # Agent config covers each group.
+                    for verify in (False, True):
+                        urls = [r.url for r in batch if bool(r.opts.verify_tls) == verify]
+                        if not urls:
+                            continue
+                        results = _native_fetch_many(
+                            urls,
+                            max_threads=max(max_workers, 4),
+                            timeout=float(config.request_timeout),
+                            verify_tls=verify,
+                            retries=3,
+                            retry_backoff=0.5,
+                            user_agent=f"pyFF/{_pyff_version}",
+                        )
+                        for u, res in zip(urls, results):
+                            if isinstance(res, Exception):
+                                log.warning(f'native fetch of {u} failed ({res}); will retry via requests')
+                            else:
+                                prefetched[u] = _NativeResponse(res)
+
+                def getter(url, verify_tls=False):
+                    r = prefetched.pop(url, None)
+                    if r is not None:
+                        return r
+                    return url_get(url, verify_tls)
+
+                def parse_contained(r: Resource) -> deque[Resource]:
+                    """Parse one resource; contain failures (log + record on
+                    the resource, like ResourceHandler.i_handle) and return
+                    its newly discovered children."""
+                    try:
+                        return r.parse(getter)
+                    except BaseException as ex:
+                        log.debug(traceback.format_exc())
+                        log.error(f'Failed handling resource {r.url}: {ex}')
+                        r.info.exception = ex
+                        return deque()
+
+                if max_workers <= 1:
+                    # Serial BFS: with a single worker an executor adds only
+                    # future/queue churn per resource (thousands of resources
+                    # for directory sources), so don't pay for one.
+                    frontier: deque[Resource] = deque(self.children)
+                    prefetch(frontier)
+                    while frontier:
+                        r = frontier.popleft()
+                        if r.url is None or r.url in seen:
+                            continue
+                        seen.add(r.url)
+                        discovered = parse_contained(r)
+                        prefetch(discovered)
+                        frontier.extend(discovered)
+                else:
+                    # Parallel dynamic frontier: children discovered by a
+                    # parse (per-file resources of a dir:// source, MDQ
+                    # sub-resources) are submitted as soon as their parent
+                    # finishes. Fetching is I/O-bound and pyuppsala releases
+                    # the GIL during parse/validate, so the workers genuinely
+                    # overlap network transfers with multi-core XML parsing.
+                    # Completions arrive over a queue (O(1) per completion,
+                    # no re-arming waiters on the whole pending set).
+                    from queue import SimpleQueue
+
+                    done_q: SimpleQueue = SimpleQueue()
+                    outstanding = 0
+                    with ThreadPoolExecutor(
+                        max_workers=max_workers, thread_name_prefix='pyff-load'
+                    ) as pool:
+
+                        def submit(resources: Iterable[Resource]) -> None:
+                            nonlocal outstanding
+                            resources = list(resources)
+                            # Batch-fetch this round's remote URLs before
+                            # handing them to workers (one GIL-free native
+                            # call for the whole round).
+                            prefetch(resources)
+                            for r in resources:
+                                if r.url is not None and r.url not in seen:
+                                    seen.add(r.url)
+                                    outstanding += 1
+                                    fut = pool.submit(parse_contained, r)
+                                    fut.add_done_callback(done_q.put)
+
+                        submit(self.children)
+                        while outstanding:
+                            fut = done_q.get()
+                            outstanding -= 1
+                            # parse_contained never raises, so result() is safe.
+                            submit(fut.result())
             self.notify()
 
     def __len__(self):
diff --git a/src/pyff/samlmd.py b/src/pyff/samlmd.py
index d4c81914..683e7cfb 100644
--- a/src/pyff/samlmd.py
+++ b/src/pyff/samlmd.py
@@ -2,18 +2,15 @@
 import re
 import traceback
 from base64 import b64decode
-from copy import deepcopy
 from datetime import datetime, timedelta
 from io import BytesIO
 from itertools import chain
 from typing import Any, Optional, Union
 
-from lxml import etree
-from lxml.builder import ElementMaker
-from lxml.etree import DocumentInvalid, Element, ElementTree
 from pydantic import Field
+from pyuppsala import etree
+from pyuppsala.etree import DocumentInvalid, Element, ElementTree
 from str2bool import str2bool
-from xmlsec.crypto import CertDict
 
 from pyff.constants import ATTRS, NF_URI, NS, config
 from pyff.exceptions import MetadataException
@@ -22,6 +19,7 @@
 from pyff.utils import (
     Lambda,
     b2u,
+    cert_dict,
     check_signature,
     datetime2iso,
     dumptree,
@@ -302,7 +300,7 @@ def parse(self, resource: Resource, content: str) -> EidasMDParserInfo:
             for ml in mdl.iter("{{{}}}MetadataLocation".format(NS['ser'])):
                 location = ml.get('Location')
                 if location:
-                    certs = CertDict(ml)
+                    certs = cert_dict(ml)
                     fingerprints = list(certs.keys())
                     fp = None
                     if len(fingerprints) > 0:
@@ -513,16 +511,21 @@ def entitiesdescriptor(
         attrs['validUntil'] = valid_until
     t = etree.Element("{{{}}}EntitiesDescriptor".format(NS['md']), **attrs)
     for entity in entities:
-        ent_insert = entity
-        if copy:
-            ent_insert = deepcopy(ent_insert)
-        t.append(ent_insert)
-
-    # Clean unused namespaces. Prefixes referenced only from QName-valued attributes
-    # (xsi:type="xsd:string") are invisible to lxml's usage tracking, so collect and
-    # preserve them explicitly - see issue #333.
-    keep_ns_prefixes = qname_prefixes(t)
-    etree.cleanup_namespaces(t, keep_ns_prefixes=keep_ns_prefixes)
+        # pyuppsala's cross-tree append deep-copies the subtree into the target document (via the
+        # native import_subtree) and never mutates the source, unlike lxml which moves the node.
+        # So the explicit deepcopy(entity) here would be a redundant second clone (serialize +
+        # reparse per entity) on the pyuppsala backend; append alone already protects the source.
+        t.append(entity)
+
+    # lxml can prune unused namespace declarations after building the aggregate.
+    # pyuppsala preserves the declarations needed by imported subtrees but does
+    # not expose lxml's optional cleanup helper, so only request cleanup from
+    # backends that implement it.
+    cleanup_namespaces = getattr(etree, 'cleanup_namespaces', None)
+    if cleanup_namespaces is not None:
+        # Prefixes referenced only from QName-valued attributes
+        # (xsi:type="xsd:string") are invisible to lxml's usage tracking.
+        cleanup_namespaces(t, keep_ns_prefixes=qname_prefixes(t))
 
     if config.devel_write_xml_to_file:
         import os
@@ -656,16 +659,15 @@ def _domains(entity):
 
 
 def with_entity_attributes(entity, cb):
-    def _stext(e):
-        if e.text is not None:
-            return e.text.strip()
-
-    for ea in entity.iter("{{{}}}EntityAttributes".format(NS['mdattr'])):
-        for a in ea.iter("{{{}}}Attribute".format(NS['saml'])):
-            an = a.get('Name', None)
-            if a is not None:
-                values = [x for x in [_stext(v) for v in a.iter("{{{}}}AttributeValue".format(NS['saml']))] if x is not None]
-                cb(an, values)
+    # Collect the (Name, [AttributeValue text...]) groups in one native pass
+    # without creating a Python proxy per node.
+    for an, values in entity.fast_collect_grouped_text(
+        "{{{}}}EntityAttributes".format(NS['mdattr']),
+        "{{{}}}Attribute".format(NS['saml']),
+        'Name',
+        "{{{}}}AttributeValue".format(NS['saml']),
+    ):
+        cb(an, values)
 
 
 def _all_domains_and_subdomains(entity):
@@ -1307,12 +1309,30 @@ def annotate_entity(e, category, title, message, source=None):
     if e.tag != "{{{}}}EntityDescriptor".format(NS['md']) and e.tag != "{{{}}}EntitiesDescriptor".format(NS['md']):
         raise MetadataException('I can only annotate EntityDescriptor or EntitiesDescriptor elements')
     subject = e.get('Name', e.get('entityID', None))
-    atom = ElementMaker(nsmap={'atom': 'http://www.w3.org/2005/Atom'}, namespace='http://www.w3.org/2005/Atom')
-    args = [atom.published(f"{datetime.now().isoformat()}"), atom.link(href=subject, rel="saml-metadata-subject")]
+    # Build the ATOM <entry> annotation directly with pyuppsala.etree elements
+    # (replacing lxml.builder.ElementMaker). All elements live in the ATOM
+    # namespace; the entry carries an "atom" prefix declaration via nsmap so the
+    # serialized output stays prefixed. The structure (published, link(s), title,
+    # category, content) mirrors the original ElementMaker construction.
+    atom_ns = 'http://www.w3.org/2005/Atom'
+
+    def _atom(parent, local_name, text=None, **attrib):
+        elt = etree.SubElement(parent, "{{{}}}{}".format(atom_ns, local_name))
+        if text is not None:
+            elt.text = text
+        for k, v in attrib.items():
+            elt.set(k, v)
+        return elt
+
+    entry = etree.Element("{{{}}}entry".format(atom_ns), nsmap={'atom': atom_ns})
+    _atom(entry, 'published', text=f"{datetime.now().isoformat()}")
+    _atom(entry, 'link', href=subject, rel="saml-metadata-subject")
     if source is not None:
-        args.append(atom.link(href=source, rel="saml-metadata-source"))
-    args.extend([atom.title(title), atom.category(term=category), atom.content(message, type="text/plain")])
-    entity_extensions(e).append(atom.entry(*args))
+        _atom(entry, 'link', href=source, rel="saml-metadata-source")
+    _atom(entry, 'title', text=title)
+    _atom(entry, 'category', term=category)
+    _atom(entry, 'content', text=message, type="text/plain")
+    entity_extensions(e).append(entry)
 
 
 def _entity_attributes(e):
@@ -1326,16 +1346,20 @@ def _entity_attributes(e):
 
 def _eattribute(e, attr, nf):
     ea = _entity_attributes(e)
-    a = ea.xpath(
-        f".//saml:Attribute[@NameFormat='{nf}' and @Name='{attr}']", namespaces=NS, smart_strings=False
-    )
-    if a is None or len(a) == 0:
-        a = etree.Element("{{{}}}Attribute".format(NS['saml']))
-        a.set('NameFormat', nf)
-        a.set('Name', attr)
-        ea.append(a)
-    else:
-        a = a[0]
+    # Search the (tiny) EntityAttributes subtree directly instead of via
+    # .xpath(): an XPath evaluation must (re)build document-wide attribute
+    # indexes after every tree mutation, and set_entity_attributes mutates
+    # between calls, so the mutate->xpath->mutate loop over N entities cost
+    # O(N * document) rebuilds. A plain subtree walk is O(subtree) and needs
+    # no index at all.
+    saml_attribute = "{{{}}}Attribute".format(NS['saml'])
+    for a in ea.iter(saml_attribute):
+        if a.get('NameFormat') == nf and a.get('Name') == attr:
+            return a
+    a = etree.Element(saml_attribute)
+    a.set('NameFormat', nf)
+    a.set('Name', attr)
+    ea.append(a)
     return a
 
 
diff --git a/src/pyff/store.py b/src/pyff/store.py
index 0b3672df..f0e2c782 100644
--- a/src/pyff/store.py
+++ b/src/pyff/store.py
@@ -5,6 +5,7 @@
 import re
 import shutil
 import time
+from copy import deepcopy
 from datetime import datetime, timedelta
 from io import BytesIO
 from threading import ThreadError
@@ -880,15 +881,29 @@ def reset(self):
     def collections(self):
         return list(self.md.keys())
 
+    def _stored_entity(self, entity):
+        """Return a compact store-owned entity subtree.
+
+        pyuppsala element proxies keep their owning document alive. Storing an
+        entity directly from a large source aggregate therefore retains the
+        whole parsed feed (and its decoded input buffer). A detached clone keeps
+        only the entity subtree in the in-memory store.
+        """
+        return deepcopy(entity)
+
     def update(self, t, tid=None, etag=None, lazy=True):
         relt = root(t)
         assert relt is not None
         if relt.tag == "{{{}}}EntityDescriptor".format(NS['md']):
-            self._unindex(relt)
-            self._index(relt)
-            self.entities[relt.get('entityID')] = relt  # TODO: merge?
+            stored = self._stored_entity(relt)
+            entity_id = stored.get('entityID')
+            old = self.entities.get(entity_id)
+            if old is not None:
+                self._unindex(old)
+            self._index(stored)
+            self.entities[entity_id] = stored  # TODO: merge?
             if tid is not None:
-                self.md[tid] = [relt.get('entityID')]
+                self.md[tid] = [entity_id]
         elif relt.tag == "{{{}}}EntitiesDescriptor".format(NS['md']):
             if tid is None:
                 tid = relt.get('Name')
diff --git a/src/pyff/test/test_pipeline.py b/src/pyff/test/test_pipeline.py
index 918322bb..616594a4 100644
--- a/src/pyff/test/test_pipeline.py
+++ b/src/pyff/test/test_pipeline.py
@@ -2,8 +2,10 @@
 import os
 import shutil
 import tempfile
+import time
+from concurrent.futures import ThreadPoolExecutor
 from io import StringIO
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 
 import pytest
 import yaml
@@ -224,7 +226,10 @@ def test_fail_on_error_invalid_entity(self):
             )
         except (MetadataException, ParserException) as ex:
             print(ex)
-            assert ":SCHEMASV:" in str(ex)
+            # pyuppsala reports schema-validation failures as pyFF's
+            # "Validation error while parsing ..." MetadataException (lxml's
+            # libxml2-specific ":SCHEMASV:" error code no longer applies).
+            assert "Validation error" in str(ex)
             assert "/metadata/test03-invalid.xml" in str(ex)
             return True
 
@@ -367,14 +372,255 @@ def test_sort_group(self):
         self._run_sort_test(expected_order, sxp, res, self.captured_log_text)
 
 
+class TestPkcs11SigningConfig:
+    """Verify parsing and validation of PKCS#11 signing selectors."""
+
+    @pytest.fixture(autouse=True)
+    def _isolated_provider_cache(self):
+        with patch.object(builtins, '_pkcs11_provider_cache', {}):
+            yield
+
+    def test_parse_absolute_module_path(self):
+        """Preserve an absolute module path and read the PIN environment selector."""
+        module, label, pin, slot_id = builtins._parse_pkcs11_key_uri(
+            "pkcs11:///usr/lib/libCryptoki2_64.so/sctest2?pin=env:LUNA_PIN"
+        )
+
+        assert module == "/usr/lib/libCryptoki2_64.so"
+        assert label == "sctest2"
+        assert pin == "env:LUNA_PIN"
+        assert slot_id is None
+
+    def test_parse_uri_slot_id(self):
+        """Extract a numeric slot ID appended to the module path."""
+        module, label, pin, slot_id = builtins._parse_pkcs11_key_uri(
+            "pkcs11:///usr/lib/libCryptoki2_64.so:17/sctest2"
+        )
+
+        assert module == "/usr/lib/libCryptoki2_64.so"
+        assert label == "sctest2"
+        assert pin == "env:PYKCS11PIN"
+        assert slot_id == 17
+
+    def test_select_token_by_label_and_serial(self):
+        """Select a token using its label and exact serial number."""
+        provider_type = MagicMock()
+        selected_provider = provider_type.with_token.return_value
+
+        with patch.object(builtins.pybergshamra, 'Pkcs11Provider', provider_type):
+            provider = builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                token_label="sc_ha",
+                token_serial=11429933786539,
+            )
+
+        assert provider is selected_provider
+        provider_type.with_token.assert_called_once_with(
+            "/usr/lib/libCryptoki2_64.so",
+            "sc_ha",
+            token_serial="11429933786539",
+        )
+
+    def test_select_slot_id(self):
+        """Select a token using an explicitly configured slot ID."""
+        provider_type = MagicMock()
+        selected_provider = provider_type.with_slot_id.return_value
+
+        with patch.object(builtins.pybergshamra, 'Pkcs11Provider', provider_type):
+            provider = builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                slot_id="17",
+            )
+
+        assert provider is selected_provider
+        provider_type.with_slot_id.assert_called_once_with("/usr/lib/libCryptoki2_64.so", 17)
+
+    def test_reuses_provider_for_equivalent_selector(self):
+        """Keep the vendor module loaded across repeated signing requests."""
+        provider_type = MagicMock()
+        selected_provider = provider_type.with_token.return_value
+
+        with patch.object(builtins.pybergshamra, 'Pkcs11Provider', provider_type):
+            first = builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                token_label="sc_ha",
+                token_serial=11429933786539,
+            )
+            second = builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                token_label="sc_ha",
+                token_serial="11429933786539",
+            )
+
+        assert first is selected_provider
+        assert second is selected_provider
+        provider_type.with_token.assert_called_once_with(
+            "/usr/lib/libCryptoki2_64.so",
+            "sc_ha",
+            token_serial="11429933786539",
+        )
+
+    def test_does_not_share_provider_between_selectors(self):
+        """Keep distinct token selections in separate cache entries."""
+        provider_type = MagicMock()
+
+        with patch.object(builtins.pybergshamra, 'Pkcs11Provider', provider_type):
+            builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                token_label="token-a",
+            )
+            builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                token_label="token-b",
+            )
+
+        assert provider_type.with_token.call_count == 2
+
+    def test_constructs_provider_once_during_concurrent_first_access(self):
+        """Serialize a cold cache so threaded requests cannot load twice."""
+        provider_type = MagicMock()
+        selected_provider = object()
+
+        def create_provider(*_args, **_kwargs):
+            time.sleep(0.05)
+            return selected_provider
+
+        provider_type.with_token.side_effect = create_provider
+
+        def select_provider():
+            return builtins._select_pkcs11_provider(
+                "/usr/lib/libCryptoki2_64.so",
+                token_label="sc_ha",
+                token_serial="11429933786539",
+            )
+
+        with (
+            patch.object(builtins.pybergshamra, 'Pkcs11Provider', provider_type),
+            ThreadPoolExecutor(max_workers=2) as executor,
+        ):
+            providers = list(executor.map(lambda _item: select_provider(), range(2)))
+
+        assert providers == [selected_provider, selected_provider]
+        provider_type.with_token.assert_called_once()
+
+    def test_pkcs11_signing_uses_owned_document(self):
+        """Keep PKCS#11 signing away from the shared native document capsule."""
+        from pyuppsala import etree
+
+        xml = """\
+<md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
+  <md:EntityDescriptor entityID="https://sp.example.org/metadata"/>
+</md:EntitiesDescriptor>
+"""
+        md = MDRepository()
+        req = Plumbing.Request(
+            Plumbing([], pid="pkcs11-owned-document"),
+            md,
+            t=etree.fromstring(xml),
+            args={
+                "key": "pkcs11:///usr/lib/libCryptoki2_64.so/sctest2",
+                "token_label": "sc_ha",
+            },
+        )
+        provider_type = MagicMock()
+
+        with (
+            patch.dict(os.environ, {"PYKCS11PIN": "secret"}),
+            patch.object(builtins.pybergshamra, 'KeysManager', MagicMock()),
+            patch.object(builtins.pybergshamra, 'DsigContext', MagicMock()),
+            patch.object(builtins.pybergshamra, 'Pkcs11Provider', provider_type),
+            patch.object(builtins.pybergshamra, 'Pkcs11Signer', MagicMock()),
+            patch.object(builtins.pybergshamra, 'sign_enveloped', side_effect=lambda _ctx, value, **_kw: value) as sign,
+            patch.object(builtins.pybergshamra, 'sign_enveloped_document') as sign_document,
+        ):
+            result = builtins.sign(req)
+
+        sign.assert_called_once()
+        sign_document.assert_not_called()
+        assert result.find("{urn:oasis:names:tc:SAML:2.0:metadata}EntityDescriptor") is not None
+
+    @pytest.mark.parametrize(
+        "kwargs, message",
+        [
+            ({"token_serial": "serial"}, "token_serial requires token_label"),
+            ({"slot_id": 17, "token_label": "sc_ha"}, "slot_id cannot be combined"),
+            ({"uri_slot_id": 17, "slot_id": 18}, "Conflicting PKCS#11 slot IDs"),
+            ({"slot_id": "not-a-number"}, "Invalid PKCS#11 slot ID"),
+        ],
+    )
+    def test_reject_invalid_or_conflicting_selectors(self, kwargs, message):
+        """Reject incomplete, malformed, or mutually exclusive selectors."""
+        with pytest.raises(PipeException, match=message):
+            builtins._select_pkcs11_provider("/usr/lib/libCryptoki2_64.so", **kwargs)
+
+
 # noinspection PyUnresolvedReferences
 class SigningTest(PipeLineTest):
     def test_signing(self):
+        """Sign and publish an aggregate without losing its entities."""
+        from pyuppsala import etree
+
+        from pyff.constants import NS
+
         self.output = tempfile.NamedTemporaryFile('w').name
-        _res, md, _ctx = self.run_pipeline("signer.fd", self)
+        res, md, _ctx = self.run_pipeline("signer.fd", self)
         eIDs = [e.get('entityID') for e in md.store]
         assert 'https://idp.aco.net/idp/shibboleth' in eIDs
         assert 'https://skriptenforum.net/shibboleth' in eIDs
+
+        entity_tag = "{{{}}}EntityDescriptor".format(NS['md'])
+        signed_tree = root(res)
+        assert len(signed_tree.findall(entity_tag)) == 2
+
+        with open(self.output, 'rb') as fd:
+            published = etree.fromstring(fd.read())
+        assert len(published.findall(entity_tag)) == 2
+        os.unlink(self.output)
+
+    def test_signing_single_entity(self):
+        # Regression test for the MDQ single-entity path: after `first` the
+        # working document is an EntityDescriptor that is still a child of the
+        # selected EntitiesDescriptor. `sign` must sign *that* element (and
+        # `publish`/`emit` must carry the signature), not the enclosing
+        # aggregate root that later gets thrown away.
+        from pyuppsala import etree
+
+        from pyff.constants import NS
+        from pyff.utils import check_signature
+
+        self.output = tempfile.NamedTemporaryFile('w').name
+        res, _md = self.exec_pipeline(
+            f"""
+- load:
+    - {self.datadir}/simple-pipeline
+- select:
+    - https://idp.aco.net/idp/shibboleth
+- first
+- finalize:
+    cacheDuration: PT5H
+    validUntil: P10D
+- sign:
+    key: {self.private_keyspec}
+    cert: {self.public_keyspec}
+- publish:
+    output: {self.output}
+"""
+        )
+        entity_tag = "{{{}}}EntityDescriptor".format(NS['md'])
+        signature_tag = "{{{}}}Signature".format(NS['ds'])
+
+        t = root(res)
+        assert t.tag == entity_tag
+        assert t.get('entityID') == 'https://idp.aco.net/idp/shibboleth'
+        assert len(t) > 0 and t[0].tag == signature_tag, "signature must be the entity's first child"
+        assert t.get('ID') is not None
+        check_signature(t, self.public_keyspec, only_one_signature=True)
+
+        with open(self.output, 'rb') as fd:
+            published = etree.fromstring(fd.read())
+        assert published.tag == entity_tag
+        assert published[0].tag == signature_tag, "published single entity must carry its signature"
+        check_signature(published, self.public_keyspec, only_one_signature=True)
         os.unlink(self.output)
 
     def test_signing_and_validation(self):
@@ -770,14 +1016,23 @@ def test_publish_keeps_xsd_prefix_qname(self):
         )
         tmpfile = tempfile.NamedTemporaryFile('w').name
         try:
-            self.exec_pipeline(
-                f"""
+            # PKCS11 signing uses the owned-string path rather than the native
+            # document path. Force the same path here without requiring an HSM.
+            with patch.object(builtins, 'is_document_root', return_value=False):
+                self.exec_pipeline(
+                    f"""
 - load:
    - file://{self.datadir}/metadata/test05-xsd-prefix-idp.xml
 - select
+- finalize:
+    cacheDuration: PT5H
+    validUntil: P10D
+- sign:
+    key: {self.private_keyspec}
+    cert: {self.public_keyspec}
 - publish: {tmpfile}
 """
-            )
+                )
             t2 = parse_xml(tmpfile)
             assert t2 is not None
             entity_elt = t2.find(".//{{{}}}EntityDescriptor[@entityID='{}']".format(NS['md'], entity))
@@ -796,6 +1051,11 @@ def test_publish_prunes_genuinely_unused_namespace(self):
         XMLSchema URI, but only 'xs' is ever referenced (via xsi:type="xs:string"). The
         genuinely unused 'xsd' declaration must still be pruned.
         """
+        from pyuppsala import etree
+
+        if not hasattr(etree, 'cleanup_namespaces'):
+            self.skipTest("the XML backend does not support namespace cleanup")
+
         entity = 'https://app.comfact.se/pdss/metadata/d70a69a512a2418f'
         tmpfile = tempfile.NamedTemporaryFile('w').name
         try:
diff --git a/src/pyff/test/test_utils.py b/src/pyff/test/test_utils.py
index 5d5a5b90..c7118711 100644
--- a/src/pyff/test/test_utils.py
+++ b/src/pyff/test/test_utils.py
@@ -121,7 +121,10 @@ def test_strip_warnings(self):
         errors = [':WARNING:', 'other']
         assert utils.xml_error(errors) == 'other'
         assert utils.xml_error(errors, m='other') == 'other'
-        assert utils.xml_error(errors, m='kaka') == ''
+        # pyuppsala's per-document validation errors don't embed the source, so
+        # xml_error now prefixes an error with the source (instead of dropping
+        # it) when the source isn't already mentioned -- keeping the detail.
+        assert utils.xml_error(errors, m='kaka') == 'kaka: other'
 
 
 class TestMisc(TestCase):
diff --git a/src/pyff/utils.py b/src/pyff/utils.py
index 3df96e65..cc542ae5 100644
--- a/src/pyff/utils.py
+++ b/src/pyff/utils.py
@@ -28,15 +28,16 @@
 from urllib.parse import urlparse
 
 import pkg_resources
+import pybergshamra
 import requests
-import xmlsec
 from apscheduler.executors.pool import ThreadPoolExecutor
 from apscheduler.jobstores.memory import MemoryJobStore
 from apscheduler.jobstores.redis import RedisJobStore
 from apscheduler.schedulers.background import BackgroundScheduler
 from cachetools import LRUCache
-from lxml import etree
-from lxml.etree import Element, ElementTree
+from cryptography import x509
+from pyuppsala import etree
+from pyuppsala.etree import Element, ElementTree
 from requests import Session
 from requests.adapters import BaseAdapter, HTTPAdapter, Response
 from requests.packages.urllib3.util.retry import Retry
@@ -49,25 +50,40 @@
 from pyff.exceptions import MetadataException, ResourceException
 from pyff.logs import get_log
 
-etree.set_default_parser(etree.XMLParser(resolve_entities=False))
+# Note: pyuppsala is safe-by-default (entities are not resolved/expanded unless
+# explicitly allowed) and exposes no set_default_parser hook, so the previous
+# call to etree.set_default_parser(...) has been dropped during the migration.
+
+# pyuppsala's default XPath node-visit budget (100k visits per evaluation) is an
+# anti-DoS cap sized for untrusted documents. pyFF evaluates XPath over its own
+# working aggregates, which at eduGAIN scale exceed a million nodes, so a plain
+# //md:EntityDescriptor would trip the default cap. Raise the module budget to a
+# value comfortably above real-world aggregate sizes while still bounding a
+# runaway evaluation.
+etree.MAX_XPATH_NODE_VISITS = max(etree.MAX_XPATH_NODE_VISITS, 50_000_000)
 
 __author__ = 'leifj'
 
 log = get_log(__name__)
 
-sentinel = object()
 thread_data = local()
 
 
 def xml_error(error_log, m=None):
-    def _f(x):
-        if ":WARNING:" in x:
-            return False
-        if m is not None and m not in x:
-            return False
-        return True
-
-    return "\n".join(filter(_f, [f"{e}" for e in error_log]))
+    # pyuppsala's ValidationError renders as just the message (line/column), and
+    # unlike lxml it does not embed the source document in each entry. The old
+    # ``m not in x`` filter therefore dropped *every* pyuppsala error, throwing
+    # away the validation detail. Instead, keep each (non-warning) error and
+    # prefix it with the source so the message still identifies the document.
+    lines = []
+    for e in error_log:
+        s = f"{e}"
+        if ":WARNING:" in s:
+            continue
+        if m is not None and m not in s:
+            s = f"{m}: {s}"
+        lines.append(s)
+    return "\n".join(lines)
 
 
 def debug_observer(e):
@@ -198,25 +214,6 @@ def first_text(elt, tag, default=None):
     return default
 
 
-class ResourceResolver(etree.Resolver):
-    def __init__(self):
-        super().__init__()
-
-    def resolve(self, system_url, public_id, context):
-        """
-        Resolves URIs using the resource API
-        """
-        # log.debug("resolve SYSTEM URL' %s' for '%s'" % (system_url, public_id))
-        path = system_url.split("/")
-        fn = path[len(path) - 1]
-        if pkg_resources.resource_exists(__name__, fn):
-            return self.resolve_file(pkg_resources.resource_stream(__name__, fn), context)
-        elif pkg_resources.resource_exists(__name__, f"schema/{fn}"):
-            return self.resolve_file(pkg_resources.resource_stream(__name__, f"schema/{fn}"), context)
-        else:
-            raise ValueError(f"Unable to locate {fn}")
-
-
 thread_local_lock = threading.Lock()
 
 
@@ -227,13 +224,21 @@ def schema():
     if thread_data.schema is None:
         try:
             thread_local_lock.acquire(blocking=True)
-            parser = etree.XMLParser()
-            parser.resolvers.add(ResourceResolver())
-            st = etree.parse(pkg_resources.resource_stream(__name__, "schema/schema.xsd"), parser)
-            thread_data.schema = etree.XMLSchema(st)
+            # pyuppsala's XMLSchema resolves xsd:import / xsd:include relative to
+            # the schema file's own directory (base_path) automatically, so the
+            # old lxml ResourceResolver / parser plumbing is no longer needed.
+            #
+            # lenient=True matches libxml2/lxml's built-in datatype validation,
+            # which pyFF has always relied on: real-world SAML metadata carries
+            # anyURI values containing spaces (e.g. mdui:GeolocationHint
+            # "geo:lat, lon", "mailto: user@host"). Strict/spec XSD rejects those
+            # per RFC 3987, which would wrongly drop large numbers of otherwise
+            # valid entities; lenient mode accepts them exactly as lxml did.
+            schema_path = pkg_resources.resource_filename(__name__, "schema/schema.xsd")
+            thread_data.schema = etree.XMLSchema(file=schema_path, lenient=True)
         except etree.XMLSchemaParseError as ex:
             traceback.print_exc()
-            log.error(xml_error(ex.error_log))
+            log.error(str(ex))
             raise ex
         finally:
             thread_local_lock.release()
@@ -263,21 +268,179 @@ def redis():
     return thread_data.redis
 
 
+def _looks_like_sha1_fingerprint(key: str) -> bool:
+    """Return True if ``key`` looks like a SHA1 certificate fingerprint.
+
+    pyFF accepts the ``verify`` value either as a path to a PEM certificate file
+    or as a SHA1 fingerprint (40 hex digits, optionally colon-separated). A
+    fingerprint is detected by stripping colons/whitespace and checking for
+    exactly 40 hex characters.
+    """
+    candidate = key.replace(':', '').replace(' ', '').strip()
+    return len(candidate) == 40 and all(c in '0123456789abcdefABCDEF' for c in candidate)
+
+
 def check_signature(t: ElementTree, key: Optional[str], only_one_signature: bool = False) -> ElementTree:
-    if key is not None:
-        log.debug(f"verifying signature using {key}")
-        refs = xmlsec.verified(t, key, drop_signature=True)
-        if only_one_signature and len(refs) != 1:
-            raise MetadataException("XML metadata contains %d signatures - exactly 1 is required" % len(refs))
-        t = refs[0]  # prevent wrapping attacks
+    """Verify the XML signature on ``t`` using pybergshamra.
+
+    ``key`` is either the path to a PEM-encoded X.509 certificate (the trusted
+    signer) or a SHA1 fingerprint of the expected signing certificate. When a
+    fingerprint is supplied the certificate embedded in the signature's KeyInfo
+    is used to verify, and the fingerprint is checked against it afterwards.
+    """
+    if key is None:
+        return t
+
+    log.debug(f"verifying signature using {key}")
+
+    mgr = pybergshamra.KeysManager()
+    ctx = pybergshamra.DsigContext(mgr)
+
+    pinned_fingerprint = None
+    if _looks_like_sha1_fingerprint(key) and not os.path.exists(key):
+        # Fingerprint pinning: trust the cert carried inside the signature's
+        # KeyInfo/X509Data, then compare its SHA1 to the pinned fingerprint.
+        # The fingerprint is the trust anchor here, so PKI chain validation is
+        # disabled (insecure) - the embedded signing cert is typically
+        # self-signed and would otherwise fail to chain to a trusted root.
+        pinned_fingerprint = key.replace(':', '').replace(' ', '').strip().lower()
+        ctx.enabled_key_data_x509 = True
+        ctx.trusted_keys_only = False
+        ctx.insecure = True
+    else:
+        # Trusted-cert path: load the PEM certificate and require it as the
+        # only acceptable signing key (skip inline KeyInfo extraction).
+        with open(key, 'rb') as fd:
+            cert_key = pybergshamra.load_x509_cert_pem(fd.read())
+        mgr.add_key(cert_key)
+        ctx.trusted_keys_only = True
+
+    relt = root(t)
+    if is_document_root(relt):
+        # Verify directly against the shared native DOM (pyuppsala document
+        # handle): no serialization of the working tree and no re-parse
+        # inside the verifier. Only valid when ``relt`` *is* the document --
+        # for a subtree the native document would be the enclosing aggregate.
+        result = pybergshamra.verify_document(ctx, etree.native_document(relt))
+    else:
+        # A subtree of a larger document must be rendered and verified on its
+        # own; the native document is the enclosing aggregate.
+        xml = dumptree(relt, xml_declaration=False)
+        if isinstance(xml, bytes):
+            xml = xml.decode('utf-8')
+        result = pybergshamra.verify(ctx, xml)
+    if not result.is_valid:
+        raise MetadataException(f"Signature verification failed: {result.reason}")
+
+    references = result.references or []
+    if only_one_signature and len(references) != 1:
+        raise MetadataException(
+            "XML metadata contains %d signatures - exactly 1 is required" % len(references)
+        )
 
-    return t
+    if pinned_fingerprint is not None:
+        # Confirm the certificate that actually verified the signature matches
+        # the pinned fingerprint (SHA1 over the DER-encoded leaf certificate).
+        chain = result.key_info.x509_chain if result.key_info is not None else []
+        if not chain:
+            raise MetadataException("No certificate found in signature to match fingerprint")
+        actual_fingerprint = hashlib.sha1(chain[0]).hexdigest().lower()
+        if actual_fingerprint != pinned_fingerprint:
+            raise MetadataException(
+                f"Signing certificate fingerprint {actual_fingerprint} does not match expected {pinned_fingerprint}"
+            )
+
+    # Anti-wrapping: the old code returned the verified reference subtree as the
+    # new working tree. With pybergshamra the enveloped signature covers the
+    # whole document root (reference URI "#<ID>" or ""), and strict_verification
+    # in the context guards against signature-wrapping. We therefore return the
+    # signed document root, which is the element the reference covers.
+    # NOTE: resolved_node_id from the verified reference is not mapped back to a
+    # pyuppsala element via the public etree API; this relies on the reference
+    # covering the document root.
+    return root(t)
 
 
 def validate_document(t):
     schema().assertValid(t)
 
 
+def cert_dict(t):
+    """Build a dict mapping SHA1 fingerprint -> base64 certificate text.
+
+    Replacement for ``xmlsec.crypto.CertDict``. Iterates over every
+    ``<ds:X509Certificate>`` element found in the tree, base64-decodes it to DER,
+    and computes the SHA1 fingerprint. The fingerprint format mirrors
+    pyXMLSecurity: lowercase hex, colon-separated (eg ``ab:cd:ef:...``), which is
+    also the format pyFF passes on to :func:`check_signature` as the ``verify``
+    value.
+
+    :param t: an Element or ElementTree to scan for certificates
+    :return: dict of {fingerprint: base64-certificate-text}
+    """
+    certs: dict[str, str] = {}
+    for cert_elt in root(t).iter("{{{}}}X509Certificate".format(NS['ds'])):
+        cert_b64 = cert_elt.text
+        if cert_b64 is None:
+            continue
+        cert_b64 = cert_b64.strip()
+        try:
+            cert_der = base64.b64decode(cert_b64)
+        except Exception:
+            continue
+        digest = hashlib.sha1(cert_der).hexdigest().lower()
+        fingerprint = ":".join(digest[i : i + 2] for i in range(0, len(digest), 2))
+        certs[fingerprint] = cert_b64
+    return certs
+
+
+class CertInfo:
+    """Lightweight wrapper around a parsed X.509 certificate.
+
+    Replacement for the dict returned by ``xmlsec.utils.b642cert``. Exposes the
+    handful of fields the certreport pipe consumes (key size, subject, and
+    expiry) backed by the ``cryptography`` library.
+    """
+
+    def __init__(self, cert: "x509.Certificate"):
+        self._cert = cert
+
+    @property
+    def keysize(self) -> Optional[int]:
+        """The public key size in bits, or None if it cannot be determined."""
+        public_key = self._cert.public_key()
+        # RSA/DSA expose key_size directly; EC exposes curve.key_size.
+        size = getattr(public_key, 'key_size', None)
+        if size is None:
+            curve = getattr(public_key, 'curve', None)
+            size = getattr(curve, 'key_size', None)
+        return size
+
+    @property
+    def subject(self) -> str:
+        """The certificate subject as an RFC 4514 string."""
+        return self._cert.subject.rfc4514_string()
+
+    @property
+    def not_after(self) -> Optional[datetime]:
+        """The certificate expiry as a timezone-aware datetime (UTC)."""
+        # cryptography >= 42 exposes not_valid_after_utc; fall back for older.
+        return getattr(self._cert, 'not_valid_after_utc', None) or self._cert.not_valid_after
+
+
+def cert_info(cert_b64: str) -> CertInfo:
+    """Parse a base64-encoded DER X.509 certificate into a :class:`CertInfo`.
+
+    Replacement for ``xmlsec.utils.b642cert``.
+
+    :param cert_b64: the base64 (DER) certificate text, eg from ds:X509Certificate
+    :return: a CertInfo exposing keysize / subject / not_after
+    """
+    cert_der = base64.b64decode(cert_b64)
+    cert = x509.load_der_x509_certificate(cert_der)
+    return CertInfo(cert)
+
+
 def request_vhost(request):
     return request.headers.get('X-Forwarded-Host', request.headers.get('Host', request.base))
 
@@ -347,6 +510,28 @@ def root(t):
         return t
 
 
+def is_document_root(elt) -> bool:
+    """Return True if ``elt`` is the root element of its owning document.
+
+    The working document is frequently a *subtree* of a larger parsed document,
+    e.g. the single EntityDescriptor that ``first`` hands on after an MDQ
+    ``select`` (it is still a child of the loaded EntitiesDescriptor). Anything
+    that reaches the native document through ``etree.native_document(elt)``
+    would then operate on the whole aggregate instead of ``elt``, so callers
+    must only take the document-native shortcut when this returns True. A
+    ``deepcopy``'d element has no parent but is not a document root either,
+    which is why the root-tree identity check is used rather than
+    ``getparent() is None``.
+    """
+    getroottree = getattr(elt, 'getroottree', None)
+    if getroottree is None:
+        return False
+    try:
+        return getroottree().getroot() is elt
+    except Exception:  # pragma: no cover - be conservative, fall back to the string path
+        return False
+
+
 def with_tree(elt, cb):
     cb(elt)
     if isinstance(elt.tag, str):
@@ -445,11 +630,17 @@ def xslt_transform(t, stylesheet, params=None):
         return transform(t, **params)
     except etree.XSLTApplyError as ex:
         for entry in transform.error_log:
-            log.error(f'\tmessage from line {entry.line}, col {entry.column}: {entry.message}')
-            log.error('\tdomain: %s (%d)' % (entry.domain_name, entry.domain))
-            log.error('\ttype: %s (%d)' % (entry.type_name, entry.type))
-            log.error('\tlevel: %s (%d)' % (entry.level_name, entry.level))
-            log.error(f'\tfilename: {entry.filename}')
+            # pyuppsala's XSLT error-log entries expose line/column/message; the
+            # libxml2-specific attributes (domain/type/level/filename) exist as
+            # neutral placeholders but may be missing, so guard the logging.
+            try:
+                log.error(f'\tmessage from line {entry.line}, col {entry.column}: {entry.message}')
+                log.error('\tdomain: %s (%d)' % (entry.domain_name, entry.domain))
+                log.error('\ttype: %s (%d)' % (entry.type_name, entry.type))
+                log.error('\tlevel: %s (%d)' % (entry.level_name, entry.level))
+                log.error(f'\tfilename: {entry.filename}')
+            except AttributeError:
+                log.error(f'\tmessage: {getattr(entry, "message", entry)}')
         raise ex
 
 
@@ -514,14 +705,16 @@ def hex_digest(data, hn='sha1'):
 
 def parse_xml(io: BinaryIO, base_url: Optional[str] = None) -> ElementTree:
     huge_xml = config.huge_xml
-    return etree.parse(
-        io, base_url=base_url, parser=etree.XMLParser(resolve_entities=False, collect_ids=False, huge_tree=huge_xml)
-    )
+    # pyuppsala is safe-by-default: it forbids DTDs/entities rather than expanding
+    # them, so resolve_entities=False (the old lxml hardening) is both unnecessary
+    # and unsupported. collect_ids has no pyuppsala equivalent (IDs are resolved on
+    # demand). huge_tree lifts the depth/expansion caps for large aggregates.
+    return etree.parse(io, base_url=base_url, parser=etree.XMLParser(huge_tree=huge_xml))
 
 
 def has_tag(t, tag):
-    tags = t.iter(tag)
-    return next(tags, sentinel) is not sentinel
+    # Keep the subtree scan in Rust and avoid materializing Python proxies.
+    return t.fast_has(tag)
 
 
 def url2host(url):
diff --git a/src/pyff/xslt/eidas-cleanup.xsl b/src/pyff/xslt/eidas-cleanup.xsl
index 5f76b5e6..73d58ee7 100644
--- a/src/pyff/xslt/eidas-cleanup.xsl
+++ b/src/pyff/xslt/eidas-cleanup.xsl
@@ -121,6 +121,15 @@
         </xsl:copy>
     </xsl:template>
 
+    <!-- Some eIDAS nodes emit xsi:type="xsd:string" without declaring xsd.
+         Recreate the metadata root with that namespace in scope so the
+         transformed document contains resolvable xsi:type QNames. -->
+    <xsl:template match="md:EntityDescriptor">
+        <md:EntityDescriptor xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+            <xsl:apply-templates select="node()|@*"/>
+        </md:EntityDescriptor>
+    </xsl:template>
+
     <!-- just copy everything else -->
     <xsl:template match="text()|comment()|@*">
         <xsl:copy/>
diff --git a/uv.lock b/uv.lock
index 9601518c..d8b5cbdc 100644
--- a/uv.lock
+++ b/uv.lock
@@ -467,15 +467,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/20/2a/1b016902351a523aa2bd446b50a5bc1175d7a7d1cf90fe2ef904f9b84ebc/cryptography-46.0.7-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:258514877e15963bd43b558917bc9f54cf7cf866c38aa576ebf47a77ddbc43a4", size = 3412829, upload-time = "2026-04-08T01:57:48.874Z" },
 ]
 
-[[package]]
-name = "defusedxml"
-version = "0.7.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/0f/d5/c66da9b79e5bdb124974bfe172b4daf3c984ebd9c2a06e2b8a4dc7331c72/defusedxml-0.7.1.tar.gz", hash = "sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69", size = 75520, upload-time = "2021-03-08T10:59:26.269Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/07/6c/aa3f2f849e01cb6a001cd8554a88d4c77c5c1a31c95bdf1cf9301e6d9ef4/defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61", size = 25604, upload-time = "2021-03-08T10:59:24.45Z" },
-]
-
 [[package]]
 name = "docutils"
 version = "0.21.2"
@@ -507,7 +498,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -909,6 +900,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
+[[package]]
+name = "pybergshamra"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/90/53/cefea6df463e4deb5242cd157e21d23fd989a79a91bef9c74dfdaa86cf57/pybergshamra-0.9.0.tar.gz", hash = "sha256:fc1c8b77ea3b3ba3bc9a3b4c5e98339ea6a5bd977b3494a26221413646dae273", size = 108261, upload-time = "2026-09-02T11:32:23.588Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/50/ec/d4de810a9905fcaf2183175a454bb7ec0246c2396500cfcdf0487ed4a14f/pybergshamra-0.9.0-cp310-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:7ca19e70fb5107bf582574d7617f24bf91914f37b69bfafb606d663c813f6e44", size = 2292231, upload-time = "2026-09-02T11:32:22.011Z" },
+]
+
 [[package]]
 name = "pyconfig"
 version = "3.2.3"
@@ -1072,14 +1072,15 @@ dependencies = [
     { name = "accept-types" },
     { name = "apscheduler" },
     { name = "cachetools" },
+    { name = "cryptography" },
     { name = "gunicorn" },
-    { name = "lxml" },
     { name = "mako" },
+    { name = "pybergshamra" },
     { name = "pyconfig" },
     { name = "pydantic" },
     { name = "pyramid" },
     { name = "pytz" },
-    { name = "pyxmlsecurity" },
+    { name = "pyuppsala" },
     { name = "pyyaml" },
     { name = "redis" },
     { name = "redis-collections" },
@@ -1118,16 +1119,16 @@ requires-dist = [
     { name = "accept-types", specifier = ">=0.4.1" },
     { name = "apscheduler", specifier = "==3.6.3" },
     { name = "cachetools", specifier = ">=5.5.2" },
-    { name = "eval-type-backport", marker = "python_full_version == '3.9.*'", specifier = ">=0.2.2" },
+    { name = "cryptography", specifier = ">=42" },
     { name = "gunicorn", specifier = ">=23.0.0" },
     { name = "gunicorn", marker = "python_full_version >= '3.10'", specifier = "==25.0.3" },
-    { name = "lxml", specifier = ">=4.1.1" },
     { name = "mako", specifier = ">=1.3.10" },
+    { name = "pybergshamra", specifier = ">=0.9.0" },
     { name = "pyconfig", specifier = ">=3.2.3,<3.3.0" },
     { name = "pydantic", specifier = ">=2.8" },
     { name = "pyramid", specifier = ">=2.0.2" },
     { name = "pytz", specifier = ">=2025.2" },
-    { name = "pyxmlsecurity", specifier = ">=1.0.0" },
+    { name = "pyuppsala", specifier = ">=0.11.0" },
     { name = "pyyaml", specifier = ">=3.10" },
     { name = "redis", specifier = ">=5.3.0" },
     { name = "redis-collections", specifier = ">=0.13.0" },
@@ -1254,18 +1255,16 @@ wheels = [
 ]
 
 [[package]]
-name = "pyxmlsecurity"
-version = "1.0.0"
+name = "pyuppsala"
+version = "0.11.0"
 source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "cryptography" },
-    { name = "defusedxml" },
-    { name = "lxml" },
-    { name = "pyconfig" },
-    { name = "requests" },
-    { name = "six" },
+sdist = { url = "https://files.pythonhosted.org/packages/73/a8/9a324fb7c5844206edcd633fb0e8d424fbc1d1d5c23806c0d50a2a1cf21e/pyuppsala-0.11.0.tar.gz", hash = "sha256:043c640c6d984a1746def838b3690f2ce679f2512f054155e0c202f71c43a561", size = 247468, upload-time = "2026-09-02T10:40:21.24Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d5/9f/ca7bf543b628b63af4929ba1a42dfb7927aa30400ef832329c7185d9e915/pyuppsala-0.11.0-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:c96b11ec5e220a1c9473a34b7b37c3c34df1e5772093ee096837195df00cfea9", size = 1716655, upload-time = "2026-09-02T10:40:15.055Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/69/155a5130c90a5fe6c49fb2e73258bbeca88fb933cd416e76ee4f5108e397/pyuppsala-0.11.0-cp310-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:8555c13db4a8d4cf4503f032a69b5c22b77d216d17e5e001f37e6dfec021e964", size = 1897723, upload-time = "2026-09-02T10:40:16.62Z" },
+    { url = "https://files.pythonhosted.org/packages/26/41/4a793a0a0571c6c8a8f1d6df7a91858d3d878833721e6d44c741a9224ee3/pyuppsala-0.11.0-cp310-abi3-win_amd64.whl", hash = "sha256:9479706c104e6f9896230215afd3fbb2c374590b7814ee3e68b23bd3152b4505", size = 1870906, upload-time = "2026-09-02T10:40:17.923Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/b2/c44883d69aa1778325621e50fca416c9e4d97622de443ffd0813a5e8d273/pyuppsala-0.11.0-cp310-abi3-win_arm64.whl", hash = "sha256:3cbea175956b3a668e053609c2e33bf1d2d9ac56f0e6ebb197a686ab86ff1817", size = 1776246, upload-time = "2026-09-02T10:40:19.32Z" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4c/37/f1f50c2bb840d97490b45f3fb658ec489d5dacc4d7c9630b67bb380cb748/pyXMLSecurity-1.0.0.tar.gz", hash = "sha256:03398d6c7eef462410c7133d0b8861d721f67678f6a66f45090aba26806d76a3", size = 31342, upload-time = "2023-08-24T12:13:01.23Z" }
 
 [[package]]
 name = "pyyaml"
@@ -1514,23 +1513,23 @@ resolution-markers = [
     "python_full_version < '3.11'",
 ]
 dependencies = [
-    { name = "alabaster" },
-    { name = "babel" },
-    { name = "colorama", marker = "sys_platform == 'win32'" },
-    { name = "docutils", version = "0.21.2", source = { registry = "https://pypi.org/simple" } },
-    { name = "imagesize" },
-    { name = "jinja2" },
-    { name = "packaging" },
-    { name = "pygments" },
-    { name = "requests" },
-    { name = "snowballstemmer" },
-    { name = "sphinxcontrib-applehelp" },
-    { name = "sphinxcontrib-devhelp" },
-    { name = "sphinxcontrib-htmlhelp" },
-    { name = "sphinxcontrib-jsmath" },
-    { name = "sphinxcontrib-qthelp" },
-    { name = "sphinxcontrib-serializinghtml" },
-    { name = "tomli" },
+    { name = "alabaster", marker = "python_full_version < '3.11'" },
+    { name = "babel", marker = "python_full_version < '3.11'" },
+    { name = "colorama", marker = "python_full_version < '3.11' and sys_platform == 'win32'" },
+    { name = "docutils", version = "0.21.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "imagesize", marker = "python_full_version < '3.11'" },
+    { name = "jinja2", marker = "python_full_version < '3.11'" },
+    { name = "packaging", marker = "python_full_version < '3.11'" },
+    { name = "pygments", marker = "python_full_version < '3.11'" },
+    { name = "requests", marker = "python_full_version < '3.11'" },
+    { name = "snowballstemmer", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-applehelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-devhelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-jsmath", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-qthelp", marker = "python_full_version < '3.11'" },
+    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version < '3.11'" },
+    { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/be0b61178fe2cdcb67e2a92fc9ebb488e3c51c4f74a36a7824c0adf23425/sphinx-8.1.3.tar.gz", hash = "sha256:43c1911eecb0d3e161ad78611bc905d1ad0e523e4ddc202a58a821773dc4c927", size = 8184611, upload-time = "2024-10-13T20:27:13.93Z" }
 wheels = [
@@ -1545,23 +1544,23 @@ resolution-markers = [
     "python_full_version == '3.11.*'",
 ]
 dependencies = [
-    { name = "alabaster" },
-    { name = "babel" },
-    { name = "colorama", marker = "sys_platform == 'win32'" },
-    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" } },
-    { name = "imagesize" },
-    { name = "jinja2" },
-    { name = "packaging" },
-    { name = "pygments" },
-    { name = "requests" },
-    { name = "roman-numerals" },
-    { name = "snowballstemmer" },
-    { name = "sphinxcontrib-applehelp" },
-    { name = "sphinxcontrib-devhelp" },
-    { name = "sphinxcontrib-htmlhelp" },
-    { name = "sphinxcontrib-jsmath" },
-    { name = "sphinxcontrib-qthelp" },
-    { name = "sphinxcontrib-serializinghtml" },
+    { name = "alabaster", marker = "python_full_version == '3.11.*'" },
+    { name = "babel", marker = "python_full_version == '3.11.*'" },
+    { name = "colorama", marker = "python_full_version == '3.11.*' and sys_platform == 'win32'" },
+    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
+    { name = "imagesize", marker = "python_full_version == '3.11.*'" },
+    { name = "jinja2", marker = "python_full_version == '3.11.*'" },
+    { name = "packaging", marker = "python_full_version == '3.11.*'" },
+    { name = "pygments", marker = "python_full_version == '3.11.*'" },
+    { name = "requests", marker = "python_full_version == '3.11.*'" },
+    { name = "roman-numerals", marker = "python_full_version == '3.11.*'" },
+    { name = "snowballstemmer", marker = "python_full_version == '3.11.*'" },
+    { name = "sphinxcontrib-applehelp", marker = "python_full_version == '3.11.*'" },
+    { name = "sphinxcontrib-devhelp", marker = "python_full_version == '3.11.*'" },
+    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version == '3.11.*'" },
+    { name = "sphinxcontrib-jsmath", marker = "python_full_version == '3.11.*'" },
+    { name = "sphinxcontrib-qthelp", marker = "python_full_version == '3.11.*'" },
+    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version == '3.11.*'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/42/50/a8c6ccc36d5eacdfd7913ddccd15a9cee03ecafc5ee2bc40e1f168d85022/sphinx-9.0.4.tar.gz", hash = "sha256:594ef59d042972abbc581d8baa577404abe4e6c3b04ef61bd7fc2acbd51f3fa3", size = 8710502, upload-time = "2025-12-04T07:45:27.343Z" }
 wheels = [
@@ -1577,23 +1576,23 @@ resolution-markers = [
     "python_full_version == '3.12.*'",
 ]
 dependencies = [
-    { name = "alabaster" },
-    { name = "babel" },
-    { name = "colorama", marker = "sys_platform == 'win32'" },
-    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" } },
-    { name = "imagesize" },
-    { name = "jinja2" },
-    { name = "packaging" },
-    { name = "pygments" },
-    { name = "requests" },
-    { name = "roman-numerals" },
-    { name = "snowballstemmer" },
-    { name = "sphinxcontrib-applehelp" },
-    { name = "sphinxcontrib-devhelp" },
-    { name = "sphinxcontrib-htmlhelp" },
-    { name = "sphinxcontrib-jsmath" },
-    { name = "sphinxcontrib-qthelp" },
-    { name = "sphinxcontrib-serializinghtml" },
+    { name = "alabaster", marker = "python_full_version >= '3.12'" },
+    { name = "babel", marker = "python_full_version >= '3.12'" },
+    { name = "colorama", marker = "python_full_version >= '3.12' and sys_platform == 'win32'" },
+    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
+    { name = "imagesize", marker = "python_full_version >= '3.12'" },
+    { name = "jinja2", marker = "python_full_version >= '3.12'" },
+    { name = "packaging", marker = "python_full_version >= '3.12'" },
+    { name = "pygments", marker = "python_full_version >= '3.12'" },
+    { name = "requests", marker = "python_full_version >= '3.12'" },
+    { name = "roman-numerals", marker = "python_full_version >= '3.12'" },
+    { name = "snowballstemmer", marker = "python_full_version >= '3.12'" },
+    { name = "sphinxcontrib-applehelp", marker = "python_full_version >= '3.12'" },
+    { name = "sphinxcontrib-devhelp", marker = "python_full_version >= '3.12'" },
+    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version >= '3.12'" },
+    { name = "sphinxcontrib-jsmath", marker = "python_full_version >= '3.12'" },
+    { name = "sphinxcontrib-qthelp", marker = "python_full_version >= '3.12'" },
+    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version >= '3.12'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/cd/bd/f08eb0f4eed5c83f1ba2a3bd18f7745a2b1525fad70660a1c00224ec468a/sphinx-9.1.0.tar.gz", hash = "sha256:7741722357dd75f8190766926071fed3bdc211c74dd2d7d4df5404da95930ddb", size = 8718324, upload-time = "2025-12-31T15:09:27.646Z" }
 wheels = [