@NonNull
  public static SSLContext fromClientCertificate(@NonNull ECKey ecKey) {
    // see also:
    // https://connect2id.com/products/nimbus-oauth-openid-connect-sdk/examples/utils/custom-key-store

    if (ecKey.getParsedX509CertChain() == null || ecKey.getParsedX509CertChain().isEmpty()) {
      throw new IllegalArgumentException(
          "client key is missing certificate, kid: " + ecKey.getKeyID());
    }

    try {
      var ctx = SSLContext.getInstance("TLS");

      var tmf = TrustManagerFactory.getInstance("PKIX");

      // Using null here initialises with the default trust store.
      tmf.init((KeyStore) null);

      ctx.init(
          keyManagerOf(ecKey.getParsedX509CertChain().get(0), ecKey.toPrivateKey()),
          tmf.getTrustManagers(),
          null);
      return ctx;
    } catch (JOSEException | GeneralSecurityException e) {
      throw new IllegalStateException("failed to initialize SSL context", e);
    }
  }
@Test
  void fromClientCertificate_noX509() throws Exception {
    var key =
        new ECKeyGenerator(Curve.P_256)
            .keyUse(KeyUse.SIGNATURE)
            .keyIDFromThumbprint(true)
            .generate();

    assertThrows(IllegalArgumentException.class, () -> TlsContext.fromClientCertificate(key));
  }