@Override
    public TrustRootsResult findTrustRoots(final List<X509Certificate> list, final Optional<ByteArray> aaguid) {
        return trustSources
            .stream()
            .map(source -> source.findTrustRoots(list, aaguid))
            .filter(result -> result != null && !result.getTrustRoots().isEmpty())
            .findFirst()
            .orElseGet(() -> TrustRootsResult.builder().trustRoots(Set.of()).build());
    }
This is {@link CompositeAttestationTrustSource}.

@author Misagh Moayyed
@since 7.0.0
support/cas-server-support-webauthn-core/src/main/java/org/apereo/cas/webauthn/metadata/CompositeAttestationTrustSource.java