code: public static boolean isSignedBy(final CMSSignedData sd,
              final X509Certificate signer) {
          SignerInformationStore store = sd.getSignerInfos();
          SignerInformation signerInfo = store.get(new JcaSignerId(signer));
          if (signerInfo == null) {
              return false;
          }
          CMSSignatureAlgorithmNameGenerator sigNameGenerator = new DefaultCMSSignatureAlgorithmNameGenerator();
          SignatureAlgorithmIdentifierFinder sigAlgorithmFinder = new DefaultSignatureAlgorithmIdentifierFinder();
          ContentVerifierProvider verifierProvider;
          try {
              verifierProvider = new JcaContentVerifierProviderBuilder()
                      .build(signer);
          } catch (OperatorCreationException e) {
              throw new RuntimeException(e);
          }
          DigestCalculatorProvider digestProvider;
          try {
              digestProvider = new JcaDigestCalculatorProviderBuilder().build();
          } catch (OperatorCreationException e1) {
              throw new RuntimeException(e1);
          }
          SignerInformationVerifier verifier = new SignerInformationVerifier(
                  sigNameGenerator, sigAlgorithmFinder, verifierProvider,
                  digestProvider);
          try {
              return signerInfo.verify(verifier);
          } catch (CMSException e) {
              return false;
          }
      }
docs: Checks if the provided signedData was signed by the entity represented by
  the provided certificate.
  
  @param sd
  the signedData to verify.
  @param signer
  the signing entity.
  @return <code>true</code> if the signedData was signed by the entity,
  <code>false</code> otherwise.