@Override
    public JcePrimitiveT getInstance(String algorithm) throws GeneralSecurityException {
      List<Provider> conscryptProviders = toProviderList("GmsCore_OpenSSL", "AndroidOpenSSL");
      Exception cause = null;
      for (Provider provider : conscryptProviders) {
        try {
          return this.jceFactory.getInstance(algorithm, provider);
        } catch (Exception e) {
          if (cause == null) {
            cause = e;
          }
        }
      }
      return this.jceFactory.getInstance(algorithm, null);
    }
The Android policy always prefer Conscrypt as a provider, but allows to fallback on the JDK
behavior if these are not available. Preferred providers will be ignored.
java_src/src/main/java/com/google/crypto/tink/subtle/EngineFactory.java