IDX10501: Signature validation failed. Azure SSO WS-Federation

I'm trying to set up Azure as the identity provider for a federated login w/our app. It seems like it should be straightforward enough and yet ...

The code:

private void ConfigureSAML2()
    {
        Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;

        App.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        App.UseCookieAuthentication(new CookieAuthenticationOptions());

        App.UseWsFederationAuthentication(
            new WsFederationAuthenticationOptions
            {
                Wtrealm = "75d8479b-5530-4e93-a685-fc0d6847c453",
                MetadataAddress = "https://login.microsoftonline.com/17ea2b4e-7ce9-4eb4-9d1a-6d7da51f1421/federationmetadata/2007-06/federationmetadata.xml",
                Notifications = new WsFederationAuthenticationNotifications
                {
                    AuthenticationFailed = context =>
                    {
                        context.HandleResponse();
                        context.Response.Redirect(ConfigurationService.BaseURL + "#/authentication?failed=true&message=" + context.Exception.Message);
                        return Task.FromResult(0);
                    }
                }
            });
    }

Unfortunately it keeps triggering the failure with Exception.Message="IDX10501: Signature validation failed. Unable to match keys: kid: 'Microsoft.IdentityModel.Xml.KeyInfo', token: 'Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityToken'." and Exception.StackTrace=

at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken) at Microsoft.Owin.Security.WsFederation.WsFederationAuthenticationHandler.d__8.MoveNext()

The wacky thing is when I see what Azure is sending me the claims look legit af. I can see my givenname, surname, email, etc all intact. I'm tempted to smash and grab what I need out of the response but I'd much prefer to get the middleware working properly.

I thought my Wtrealm value looked weird but that's the only way Azure knows what I'm talking about. I'm having trouble finding many examples of WS-Federation with Azure. Unfortunately OpenId Connect is not an option for us (we already had that working btw).