@Override
  public EntityStatementJWS establishIdpTrust(URI issuer) {

    var trustedFederationStatement = fetchTrustedFederationStatement(issuer);

    // the federation statement from the master will establish trust in the JWKS and the issuer URL
    // of the idp,
    // we still need to fetch the entity configuration directly afterward to get the full
    // entity statement

    return fetchTrustedEntityConfiguration(issuer, trustedFederationStatement.body().jwks());
  }
@Test
  void establishTrust() {

    var client = new FederationMasterClientImpl(FEDERATION_MASTER, federationApiClient, clock);

    var issuer = URI.create("https://idp-tk.example.com");
    var federationFetchUrl = FEDERATION_MASTER.resolve("/fetch");

    var fedmasterKeypair = ECKeyGenerator.example();

    var fedmasterEntityConfigurationJws =
        federationFetchFedmasterConfiguration(federationFetchUrl, fedmasterKeypair);

    var sectoralIdpKeypair = ECKeyGenerator.generate();
    var trustedFederationStatement =
        trustedFederationStatement(issuer, sectoralIdpKeypair, fedmasterKeypair);
    var sectoralEntityConfiguration = sectoralIdpEntityConfiguration(issuer, sectoralIdpKeypair);

    when(federationApiClient.fetchEntityConfiguration(FEDERATION_MASTER))
        .thenReturn(fedmasterEntityConfigurationJws);

    when(federationApiClient.fetchFederationStatement(
            federationFetchUrl, FEDERATION_MASTER.toString(), issuer.toString()))
        .thenReturn(trustedFederationStatement);

    when(federationApiClient.fetchEntityConfiguration(issuer))
        .thenReturn(sectoralEntityConfiguration);

    // when
    var entityStatementJWS = client.establishIdpTrust(issuer);

    // then
    assertEquals(entityStatementJWS.body().sub(), issuer.toString());
  }