I'm pointing this one at Scott Cantor since he will remember the pain much more cleanly than me.
The default encoding for net.shibboleth.idp.saml.nameid.impl.ComputedPersistentIdGenerationStrategy is BASE64.
ISTR that we discussed moving this over to V4 since it is in principal a breaking change. However this will gratuitously break existing installs, so maybe not. Perhaps the idea is to force it in the examples?