docs: public void applyXMLDSigAsFirstChild (@Nonnull final PrivateKey aPrivateKey,
                                          @Nonnull final X509Certificate aCertificate,
                                          @Nonnull final Document aDocument) throws Exception
    {
      ValueEnforcer.notNull (aPrivateKey, "privateKey");
      ValueEnforcer.notNull (aCertificate, "certificate");
      ValueEnforcer.notNull (aDocument, "document");
      ValueEnforcer.notNull (aDocument.getDocumentElement (), "Document is missing a document element");
      if (aDocument.getDocumentElement ().getChildNodes ().getLength () == 0)
        throw new IllegalArgumentException ("Document element has no children!");
  
      // Check that the document does not contain another Signature element
      final NodeList aNodeList = aDocument.getElementsByTagNameNS (XMLSignature.XMLNS, XMLDSigSetup.ELEMENT_SIGNATURE);
      if (aNodeList.getLength () > 0)
        throw new IllegalArgumentException ("Document already contains an XMLDSig Signature element!");
  
      // Create the XMLSignature, but don't sign it yet.
      final XMLSignature aXMLSignature = createXMLSignature (aCertificate);
  
      // Create a DOMSignContext and specify the RSA PrivateKey and
      // location of the resulting XMLSignature's parent element.
      // -> The signature is always the first child element of the document
      // element for ebInterface
      final DOMSignContext aDOMSignContext = new DOMSignContext (aPrivateKey,
                                                                 aDocument.getDocumentElement (),
                                                                 aDocument.getDocumentElement ().getFirstChild ());
  
      // The namespace prefix to be used for the signed XML
      aDOMSignContext.setDefaultNamespacePrefix (DEFAULT_NS_PREFIX);
  
      // Marshal, generate, and sign the enveloped signature.
      aXMLSignature.sign (aDOMSignContext);
    }