code: public static BitSet decodeBitString(ByteBuffer buf) {
          DerId id = DerId.decode(buf);
          if (!id.matches(DerId.TagClass.UNIVERSAL, DerId.EncodingType.PRIMITIVE, ASN1_BIT_STRING_TAG_NUM)
                  && !id.matches(DerId.TagClass.UNIVERSAL, DerId.EncodingType.CONSTRUCTED, ASN1_BIT_STRING_TAG_NUM)) {
              throw new IllegalArgumentException("Expected BIT STRING identifier, received " + id);
          }
          int len = DerUtils.decodeLength(buf);
          if (buf.remaining() < len) {
              throw new IllegalArgumentException("Insufficient content for BIT STRING");
          }
  
          // If primitive encoding, then the initial octet is just used for padding
          if (id.getEncodingType() == DerId.EncodingType.PRIMITIVE) {
              buf.get();
              len--;
          }
  
          int nbits = len * 8;
          BitSet bits = new BitSet(nbits);
          for (int i = 0; i < len; i++) {
              short next = (short) (0xff & buf.get());
              int bitIndex = (i + 1) * 8 - 1;
              while (next != 0) {
                  if ((next & 1) == 1) {
                      bits.set(bitIndex);
                  }
                  bitIndex--;
                  next >>>= 1;
              }
          }
          return bits;
      }
docs: Decode an ASN.1 BIT STRING.
  
  @param buf
  the buffer containing the DER-encoded BIT STRING.
  @return the bits in the BIT STRING