code: private void assertIsFromSns(URI certUrl) {
          if (!endpoint.equals(certUrl.getHost())) {
              throw new SdkClientException(
                  String.format("SigningCertUrl does not match expected endpoint. Expected %s but received endpoint was %s.",
                                endpoint, certUrl.getHost()));
  
          }
      }
docs: If the signing cert URL is not from SNS fail.