protected String signToken(final OAuthRegisteredService registeredService,
                               final JwtClaims claims,
                               final PublicJsonWebKey jsonWebKey) {
        LOGGER.debug("Service [{}] is set to sign id tokens", registeredService.getServiceId());
        return JsonWebTokenSigner.builder()
            .key(Optional.ofNullable(jsonWebKey)
                .map(PublicJsonWebKey::getPrivateKey)
                .orElse(null))
            .keyId(Optional.ofNullable(jsonWebKey)
                .map(PublicJsonWebKey::getKeyId)
                .orElseGet(() -> UUID.randomUUID().toString()))
            .algorithm(getJsonWebKeySigningAlgorithm(registeredService, jsonWebKey))
            .allowedAlgorithms(new LinkedHashSet<>(getAllowedSigningAlgorithms(registeredService)))
            .mediaType(getSigningMediaType())
            .headers(Map.of(OAuth20Constants.CLIENT_ID, registeredService.getClientId()))
            .build()
            .sign(claims);
    }
Gets allowed signing algorithms.
Returning an empty collection indicates that all algorithms should be supported, except none.

@param registeredService the svc
@return the allowed signing algorithms
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/ticket/BaseTokenSigningAndEncryptionService.java