@Override
  public EntityStatementJWS establishIdpTrust(URI issuer) {

    var trustedFederationStatement = fetchTrustedFederationStatement(issuer);

    // the federation statement from the master will establish trust in the JWKS and the issuer URL
    // of the idp,
    // we still need to fetch the entity configuration directly afterward to get the full
    // entity statement

    return fetchTrustedEntityConfiguration(issuer, trustedFederationStatement.body().jwks());
  }
@Test
  void establishTrust_expiredFedmasterConfig() {

    var client = new FederationMasterClientImpl(FEDERATION_MASTER, federationApiClient, clock);

    var issuer = URI.create("https://idp-tk.example.com");

    var fedmasterKeypair = ECKeyGenerator.example();

    var fedmasterEntityConfigurationJws = expiredFedmasterConfiguration(fedmasterKeypair);

    when(federationApiClient.fetchEntityConfiguration(FEDERATION_MASTER))
        .thenReturn(fedmasterEntityConfigurationJws);

    // when
    var e = assertThrows(FederationException.class, () -> client.establishIdpTrust(issuer));

    // then
    assertEquals(
        "entity statement of 'https://fedmaster.example.com' expired or not yet valid",
        e.getMessage());
  }