docs: private static void verifySignature(
        X509CertificateHolder cert,
        byte[] sig, byte[] data, AlgorithmIdentifier idf) throws CertificateException
    {
      try
      {
        String algorithm = SIGNATURE_OID_TO_STRING.get(idf.getAlgorithm());
        if (algorithm == null)
        {
          throw new NoSuchAlgorithmException(
              String.format("Unsupported signature OID. OID: %s", idf));
        }
        Signature signer = Signature.getInstance(
            algorithm, BouncyCastleProvider.PROVIDER_NAME);
  
        X509Certificate c = CONVERTER_X509.getCertificate(cert);
        signer.initVerify(c.getPublicKey());
        signer.update(data);
        if (!signer.verify(sig))
        {
          throw new CertificateEncodingException(
              String.format("Failed to verify the signature. Potentially the " +
                            "data was not generated by by the cert, %s", cert.getSubject()));
        }
      }
      catch (NoSuchAlgorithmException | NoSuchProviderException |
          InvalidKeyException | SignatureException ex)
      {
        throw new CertificateEncodingException(
            "Failed to verify the signature.", ex);
      }
    }