class SigningCertFromMetadataExtractor {

    public X509Certificate getSigningCertForCurrentSigningKey(PublicKey publicSigningKey) {
        CriteriaSet criteriaSet = new CriteriaSet(
            new EntityIdCriterion(hubEntityId),
            new UsageCriterion(UsageType.SIGNING),
            new ProtocolCriterion(SAMLConstants.SAML20P_NS),
            new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
            new EvaluablePublicKeyCredentialCriterion(publicSigningKey)
        );
        try {
            Credential credential = credentialResolver.resolveSingle(criteriaSet);
            if (credential instanceof X509Credential) {
                X509Certificate x509Cert = ((X509Credential)credential).getEntityCertificate();
                if (x509Cert.getPublicKey().equals(publicSigningKey)){
                    return x509Cert;
                }
            }
        } catch (ResolverException e) {
            throw new SigningKeyExtractionException("Unable to resolve metadata.", e);
        }
        throw new SigningKeyExtractionException("Certificate for public signing key not found in metadata.");
    }

    @Inject public  SigningCertFromMetadataExtractor(@Named(VERIFY_METADATA_RESOLVER) MetadataResolver metadataResolver,
                                            @Named("HubEntityId") String hubEntityId);

}