code: public Response unprotectResponse(Response response) throws IOException {
          try {
              if (!supportsProtection() || !HttpHeaders.hasBody(response)) {
                  return response;
              }
  
              if (!response.header("content-type").toLowerCase().contains("application/jose+json")) {
                  return response;
              }
  
              JWSObject jwsObject = JWSObject.deserialize(response.body().string());
              JWSHeader jwsHeader = jwsObject.jwsHeader();
  
              if (!jwsHeader.kid().equals(serverSignatureKey.kid()) || !jwsHeader.alg().equals("RS256")) {
                  throw new IOException("Invalid protected response");
              }
  
              byte[] data = (jwsObject.originalProtected() + "." + jwsObject.payload()).getBytes(MESSAGE_ENCODING);
              byte[] signature = MessageSecurityHelper.base64UrltoByteArray(jwsObject.signature());
  
              RsaKey serverSignatureRsaKey = new RsaKey(serverSignatureKey.kid(), serverSignatureKey.toRSA(false));
              boolean signed = serverSignatureRsaKey.verifyAsync(getSha256(data), signature, "RS256").get();
              if (!signed) {
                  throw new IOException("Wrong signature.");
              }
  
              String decrypted = unprotectPayload(jwsObject.payload());
  
              MediaType contentType = response.body().contentType();
              ResponseBody body = ResponseBody.create(contentType, decrypted);
              return response.newBuilder().body(body).build();
          } catch (ExecutionException e) {
              // unexpected;
              return null;
          } catch (InterruptedException e) {
              // unexpected;
              return null;
          } catch (NoSuchAlgorithmException e) {
              // unexpected;
              return null;
          }
      }
docs: Unprotects response if needed. Replaces its body with unencrypted version.
  
  @param response
  server response.
  
  @return new response with unencrypted body if supported or existing response.
  
  @throws IOException throws IOException