@Test
public void testShouldThrowIfSignatureForSignedKeyIsIncorrectInECV2SigningOnly()
    throws Exception {

  PaymentMethodTokenRecipient recipient =
      new PaymentMethodTokenRecipient.Builder()
          .protocolVersion(PaymentMethodTokenConstants.PROTOCOL_VERSION_EC_V2_SIGNING_ONLY)
          .senderVerifyingKeys(GOOGLE_VERIFYING_PUBLIC_KEYS_JSON)
          .recipientId(RECIPIENT_ID)
          .build();
  JSONObject payload = new JSONObject(signECV2SigningOnly(PLAINTEXT));
  JSONArray signatures =
      payload.getJSONObject("intermediateSigningKey").getJSONArray("signatures");
  String correctSignature = signatures.getString(0);
  byte[] wrongSignatureBytes = Base64.decode(correctSignature);
  wrongSignatureBytes[0] = (byte) ~wrongSignatureBytes[0];
  payload
      .getJSONObject("intermediateSigningKey")
      .put("signatures", new JSONArray().put(Base64.encode(wrongSignatureBytes)));
  try {
    recipient.unseal(payload.toString());
    fail("Expected GeneralSecurityException");
  } catch (GeneralSecurityException e) {
    assertEquals("cannot verify signature", e.getMessage());
  }
}