@Override
    public JcePrimitiveT getInstance(String algorithm) throws GeneralSecurityException {
      List<Provider> conscryptProviders =
          toProviderList("GmsCore_OpenSSL", "AndroidOpenSSL", "Conscrypt");
      Exception cause = null;
      for (Provider provider : conscryptProviders) {
        try {
          return this.jceFactory.getInstance(algorithm, provider);
        } catch (Exception e) {
          if (cause == null) {
            cause = e;
          }
        }
      }
      throw new GeneralSecurityException("No good Provider found.", cause);
    }
The FIPS policy, only allows Conscrypt as a provider. No other provider will be used, and any
preferred provider will be ignored.
java_src/src/main/java/com/google/crypto/tink/subtle/EngineFactory.java