Thanks for clarifying this Stephen - that confused the hell out of me. I was viewing the XML and couldn't understand why there were no valid LTI details provided. Agreed that Instructure have no business calling these LTI resources if they don't employ LTI to authenticate users.
~ Rodney