findBestJwsProcessor

Returns the best available signing key for algorithm and the optional keyId.

Look-up order:

  1. A key registered with both algorithm and keyId (exact match).

  2. A key registered with algorithm and no key ID (algorithm-only fallback), when keyId is non-null and has no exact match.

  3. The delegateKeyRegistry, if one is set.

Return

the matching BaseJwsProcessor, or null if none is found

Parameters

algorithm

the signing algorithm the key must support

keyId

optional key ID to narrow the look-up