static void validateSignature(Credential validationCredential, SignableSAMLObject signableObj,
                                  boolean signatureRequired) {
        requireNonNull(validationCredential, "validationCredential");
        requireNonNull(signableObj, "signableObj");

        // Reject the object if signature is missing, unless allowed explicitly.
        final Signature signature = signableObj.getSignature();
        if (signature == null || !signableObj.isSigned()) {
            if (signatureRequired) {
                throw new InvalidSamlRequestException("rejecting due to a missing signature");
            } else {
                return;
            }
        }

        try {
            signatureProfileValidator.validate(signature);
            SignatureValidator.validate(signature, validationCredential);
        } catch (SignatureException e) {
            throw new InvalidSamlRequestException("failed to validate a signature", e);
        }
    }
Signs the specified {@link SignableSAMLObject} with the specified {@link Credential} and
{@code signatureAlgorithm}.
saml/src/main/java/com/linecorp/armeria/server/saml/SamlMessageUtil.java