@Test
public void testShouldFailIfSignedMessageWasChangedInECV2SigningOnly() throws Exception {

  PaymentMethodTokenRecipient recipient =
      new PaymentMethodTokenRecipient.Builder()
          .protocolVersion(PaymentMethodTokenConstants.PROTOCOL_VERSION_EC_V2_SIGNING_ONLY)
          .senderVerifyingKeys(GOOGLE_VERIFYING_PUBLIC_KEYS_JSON)
          .recipientId(RECIPIENT_ID)
          .build();
  JSONObject payload = new JSONObject(signECV2SigningOnly(PLAINTEXT));
  payload.put(
      PaymentMethodTokenConstants.JSON_SIGNED_MESSAGE_KEY,
      payload.getString(PaymentMethodTokenConstants.JSON_SIGNED_MESSAGE_KEY) + " ");
  try {
    recipient.unseal(payload.toString());
    fail("Expected GeneralSecurityException");
  } catch (GeneralSecurityException e) {
    assertEquals("cannot verify signature", e.getMessage());
  }
}