@Override
    public Resource resolveEncryptionKey(final Optional<SamlRegisteredService> registeredService) throws Throwable {
        val metadataDocument = fetch(registeredService);
        if (metadataDocument != null && metadataDocument.isValid()) {
            val data = metadataDocument.getEncryptionKey();
            LOGGER.trace("Fetching encryption key resource for metadata document [{}]", metadataDocument.getId());
            val decodedKeyContent = metadataCipherExecutor.decode(data);
            return resolveContentToResource(decodedKeyContent);
        }
        return ResourceUtils.EMPTY_RESOURCE;
    }
This is {@link AbstractSamlIdPMetadataLocator}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/idp/metadata/locator/AbstractSamlIdPMetadataLocator.java