For increased security it would be nice if you could configure what attributes go out to what SPs. If SP-A needs only username and SP-B needs username, First and Last name and phone number – why send all the extra data to SP-A.

Example of an implementation https://simplesamlphp.org/docs/stable/core:authproc_attributelimit