private fun decodePkcs8(
      data: ByteString,
      keyAlgorithm: String,
    ): PrivateKey {
      try {
        val keyFactory = KeyFactory.getInstance(keyAlgorithm)
        return keyFactory.generatePrivate(PKCS8EncodedKeySpec(data.toByteArray()))
      } catch (e: GeneralSecurityException) {
        throw IllegalArgumentException("failed to decode private key", e)
      }
    }
  }

      )
    val keyFactory = KeyFactory.getInstance("RSA")
    val publicKey = keyFactory.generatePublic(X509EncodedKeySpec(x509PublicKey.toByteArray()))
    val privateKey = keyFactory.generatePrivate(PKCS8EncodedKeySpec(privateKeyBytes.toByteArray()))

    val certificate =
      HeldCertificate
        .Builder()
        .keyPair(publicKey, privateKey)
        .build()