private static byte []
sign(PrivateKey privkey, PublicKey pubkey, int alg, byte [] data,
     String provider) throws DNSSECException
{
	byte [] signature;
	try {
		Signature s;
		if (provider != null)
			s = Signature.getInstance(algString(alg), provider);
		else
			s = Signature.getInstance(algString(alg));
		s.initSign(privkey);
		s.update(data);
		signature = s.sign();
	}
	catch (GeneralSecurityException e) {
		throw new DNSSECException(e.toString());
	}

	if (pubkey instanceof DSAPublicKey) {
		try {
			DSAPublicKey dsa = (DSAPublicKey) pubkey;
			BigInteger P = dsa.getParams().getP();
			int t = (BigIntegerLength(P) - 64) / 8;
			signature = DSASignaturetoDNS(signature, t);
		}
		catch (IOException e) {
			throw new IllegalStateException();
		}
	} else if (pubkey instanceof ECPublicKey) {
		try {
			switch (alg) {
			case Algorithm.ECC_GOST:
				// Wire format is equal to the engine output
				break;
			case Algorithm.ECDSAP256SHA256:
				signature = ECDSASignaturetoDNS(signature,
								ECDSA_P256);
				break;
			case Algorithm.ECDSAP384SHA384:
				signature = ECDSASignaturetoDNS(signature,
								ECDSA_P384);
				break;
			default:
				throw new UnsupportedAlgorithmException(alg);
			}
		}
		catch (IOException e) {
			throw new IllegalStateException();
		}
	}

	return signature;
}
Verify a DNSSEC signature.
@param rrset The data to be verified.
@param rrsig The RRSIG record containing the signature.
@param key The DNSKEY record to verify the signature with.
@throws UnsupportedAlgorithmException The algorithm is unknown
@throws MalformedKeyException The key is malformed
@throws KeyMismatchException The key and signature do not match
@throws SignatureExpiredException The signature has expired
@throws SignatureNotYetValidException The signature is not yet valid
@throws SignatureVerificationException The signature does not verify.
@throws DNSSECException Some other error occurred.
src/main/java/core/org/xbill/DNS/DNSSEC.java