class InstanceValidator {

    public boolean isValidInstance(InstanceConfirmation instanceConfirmation) {
        SignedIdentityDocument signedIdentityDocument = EntityBindingsMapper.toSignedIdentityDocument(instanceConfirmation.signedIdentityDocument);
        VespaUniqueInstanceId providerUniqueId = signedIdentityDocument.providerUniqueId();
        ApplicationId applicationId = ApplicationId.from(
                providerUniqueId.tenant(), providerUniqueId.application(), providerUniqueId.instance());

        VespaUniqueInstanceId csrProviderUniqueId = getVespaUniqueInstanceId(instanceConfirmation);
        if(! providerUniqueId.equals(csrProviderUniqueId)) {
            log.log(Level.WARNING, String.format("Instance %s has invalid provider unique ID in CSR (%s)", providerUniqueId, csrProviderUniqueId));
            return false;
        }

        if (! isSameIdentityAsInServicesXml(applicationId, instanceConfirmation.domain, instanceConfirmation.service)) {
            return false;
        }

        log.log(Level.FINE, () -> String.format("Validating instance %s.", providerUniqueId));

        PublicKey publicKey = keyProvider.getPublicKey(signedIdentityDocument.signingKeyVersion());
        if (signer.hasValidSignature(signedIdentityDocument, publicKey)) {
            log.log(Level.FINE, () -> String.format("Instance %s is valid.", providerUniqueId));
            return true;
        }
        log.log(Level.SEVERE, () -> String.format("Instance %s has invalid signature.", providerUniqueId));
        return false;
    }

    @Inject public  InstanceValidator(KeyProvider keyProvider,
                             SuperModelProvider superModelProvider,
                             NodeRepository nodeRepository,
                             AthenzProviderServiceConfig config);
    public  InstanceValidator(KeyProvider keyProvider,
                             SuperModelProvider superModelProvider,
                             NodeRepository nodeRepository,
                             IdentityDocumentSigner identityDocumentSigner,
                             AthenzService tenantIdentity);

}