static Set<String> getSupportedClientKeyTypes(byte[] clientCertificateTypes,
            int[] signatureAlgs) {
        Set<String> fromClientCerts = new HashSet<>(clientCertificateTypes.length);
        for (byte keyTypeCode : clientCertificateTypes) {
            String keyType = SSLUtils.getClientKeyType(keyTypeCode);
            if (keyType == null) {
                // Unsupported client key type -- ignore
                continue;
            }
            fromClientCerts.add(keyType);
        }
        // Signature algorithms are listed in preference order
        Set<String> fromSigAlgs = new LinkedHashSet<>(signatureAlgs.length);
        for (int signatureAlg : signatureAlgs) {
            String keyType = SSLUtils.getClientKeyTypeFromSignatureAlg(signatureAlg);
            if (keyType == null) {
                // Unsupported client key type -- ignore
                continue;
            }
            fromSigAlgs.add(keyType);
        }
        // If both are specified, the key needs to meet both sets of requirements.  Otherwise,
        // just meet the set of requirements that were specified.  See RFC 5246, section 7.4.4.
        // (In TLS 1.3, certificate_types is no longer used and is never present.)
        if (clientCertificateTypes.length > 0 && signatureAlgs.length > 0) {
            fromSigAlgs.retainAll(fromClientCerts);
            return fromSigAlgs;
        } else if (signatureAlgs.length > 0) {
            return fromSigAlgs;
        } else {
            return fromClientCerts;
        }
    }
Gets the supported key types for client certificates based on the
{@code ClientCertificateType} values provided by the server.

@param clientCertificateTypes
        {@code ClientCertificateType} values provided by the server.
        See https://www.ietf.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-2.
@param signatureAlgs
        {@code SignatureScheme} values provided by the server.
        See https://www.ietf.org/assignments/tls-parameters/tls-parameters.xml#tls-signaturescheme
@return supported key types that can be used in {@code X509KeyManager.chooseClientAlias} and
{@code X509ExtendedKeyManager.chooseEngineClientAlias}.  If the inputs imply a preference
order, the returned set will have an iteration order that respects that preference order,
otherwise it will be in an arbitrary order.

Visible for testing.
common/src/main/java/org/conscrypt/SSLUtils.java