public static Optional<JsonWebKeySet> fetchJsonWebKeySetForSigning(
        final RegisteredService registeredService,
        final OidcRegisteredServiceJwtCipherExecutor cipherExecutor,
        final boolean fallbackToDefault) {
        val oidcRegisteredService = (OidcRegisteredService) registeredService;
        val issuer = cipherExecutor.getOidcIssuerService().determineIssuer(Optional.of(oidcRegisteredService));
        LOGGER.trace("Using issuer [{}] to determine JWKS from default keystore cache", issuer);
        val serviceJsonWebKeys = Objects.requireNonNull(cipherExecutor.getRegisteredServiceJsonWebKeystoreCache().get(
            new OidcJsonWebKeyCacheKey(oidcRegisteredService, OidcJsonWebKeyUsage.SIGNING)));
        if (serviceJsonWebKeys.isPresent()) {
            val jsonWebKey = serviceJsonWebKeys.get();
            LOGGER.debug("Found JSON web key to sign the token: [{}]", jsonWebKey);
            val keys = jsonWebKey.getJsonWebKeys().stream()
                .filter(key -> key.getKey() != null).collect(Collectors.toList());
            return Optional.of(new JsonWebKeySet(keys));
        }
        if (fallbackToDefault) {
            val cacheKey = new OidcJsonWebKeyCacheKey(issuer, OidcJsonWebKeyUsage.SIGNING);
            val defaultJsonWebKeys = cipherExecutor.getDefaultJsonWebKeystoreCache().get(cacheKey);
            if (defaultJsonWebKeys != null) {
                return Optional.of(defaultJsonWebKeys);
            }
        }
        LOGGER.warn("No [{}] key could be found for issuer [{}]", OidcJsonWebKeyUsage.SIGNING, issuer);
        return Optional.empty();
    }
Fetch json web key set for signing operations.

@param registeredService the registered service
@param cipherExecutor    the cipher executor
@param fallbackToDefault the fallback to default
@return the optional
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/jwks/OidcJsonWebKeyStoreUtils.java