private fun decodePkcs8(
      data: ByteString,
      keyAlgorithm: String,
    ): PrivateKey {
      try {
        val keyFactory = KeyFactory.getInstance(keyAlgorithm)
        return keyFactory.generatePrivate(PKCS8EncodedKeySpec(data.toByteArray()))
      } catch (e: GeneralSecurityException) {
        throw IllegalArgumentException("failed to decode private key", e)
      }
    }
  }