static byte[][] encodeSubjectX509Principals(X509Certificate[] certificates)
            throws CertificateEncodingException {
        byte[][] principalBytes = new byte[certificates.length][];
        for (int i = 0; i < certificates.length; i++) {
            principalBytes[i] = certificates[i].getSubjectX500Principal().getEncoded();
        }
        return principalBytes;
    }
Gets the supported key types for client certificates based on the
{@code ClientCertificateType} values provided by the server.

@param clientCertificateTypes
        {@code ClientCertificateType} values provided by the server.
        See https://www.ietf.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-2.
@param signatureAlgs
        {@code SignatureScheme} values provided by the server.
        See https://www.ietf.org/assignments/tls-parameters/tls-parameters.xml#tls-signaturescheme
@return supported key types that can be used in {@code X509KeyManager.chooseClientAlias} and
{@code X509ExtendedKeyManager.chooseEngineClientAlias}.  If the inputs imply a preference
order, the returned set will have an iteration order that respects that preference order,
otherwise it will be in an arbitrary order.

Visible for testing.
common/src/main/java/org/conscrypt/SSLUtils.java