docs: static ClientAssertion buildJwt(final AsymmetricKeyCredential credential,
              final String jwtAudience) throws AuthenticationException {
          if (credential == null) {
              throw new IllegalArgumentException("credential is null");
          }
  
          final long time = System.currentTimeMillis();
  
          final JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
                  .audience(Collections.singletonList(jwtAudience))
                  .issuer(credential.getClientId())
                  .jwtID(UUID.randomUUID().toString())
                  .notBeforeTime(new Date(time))
                  .expirationTime(new Date(time
                                  + AuthenticationConstants.AAD_JWT_TOKEN_LIFETIME_SECONDS
                                  * 1000))
                  .subject(credential.getClientId())
                  .build();
  
          SignedJWT jwt;
          try {
              JWSHeader.Builder builder = new Builder(JWSAlgorithm.RS256);
              List<Base64> certs = new ArrayList<Base64>();
              certs.add(new Base64(credential.getPublicCertificate()));
              builder.x509CertChain(certs);
              builder.x509CertThumbprint(new Base64URL(credential
                      .getPublicCertificateHash()));
              jwt = new SignedJWT(builder.build(), claimsSet);
              final RSASSASigner signer = new RSASSASigner(credential.getKey());
  
              jwt.sign(signer);
          }
          catch (final Exception e) {
              throw new AuthenticationException(e);
          }
  
          return new ClientAssertion(jwt.serialize());
      }