private Key getEncryptionKeyForDecryption(final RegisteredService registeredService) {
        val svc = (OAuthRegisteredService) registeredService;
        if (svc instanceof OidcRegisteredService) {
            val jwks = Objects.requireNonNull(cipherExecutor.getRegisteredServiceJsonWebKeystoreCache().get(
                new OidcJsonWebKeyCacheKey(svc, OidcJsonWebKeyUsage.ENCRYPTION)));
            if (jwks.isEmpty()) {
                LOGGER.warn("Service [{}] with client id [{}] is configured to encrypt tokens, yet no JSON web key is available",
                    svc.getServiceId(), svc.getClientId());
                return null;
            }
            val jsonWebKey = (PublicJsonWebKey) jwks.get().getJsonWebKeys().getFirst();
            LOGGER.debug("Found JSON web key to encrypt the token: [{}]", jsonWebKey);
            if (jsonWebKey.getPrivateKey() == null) {
                LOGGER.info("JSON web key used to encrypt the token has no associated private key, "
                            + "when operating on service [{}] with client id [{}]. Operations that deal "
                            + "with JWT encryption/decryption may not be functional, until a private "
                            + "key can be loaded for JSON web key [{}]",
                    svc.getServiceId(), svc.getClientId(), jsonWebKey.getKeyId());
                return null;
            }
            return jsonWebKey.getPrivateKey();
        }
        return null;
    }
Get ticket cipher executor.

@param signingKey        the signing key
@param encryptionKey     the encryption key
@param registeredService the registered service
@param cipherExecutor    the cipher executor
@return the jwt ticket cipher executor
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/util/InternalJwtAccessTokenCipherExecutor.java