[java-opensaml] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Tue Jun 6 12:23:53 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=8bebd2b862fd505f0886d080183bf4b62b1ad890

The following commit(s) were added to refs/heads/main by this push:
     new 8bebd2b86 IDP-2083 - Treat NonnullElements as the default for collections
8bebd2b86 is described below

commit 8bebd2b862fd505f0886d080183bf4b62b1ad890
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 6 08:23:47 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Review opensaml-xmlsec-api/impl.
    Eliminate some additional Nonnull Integer APIs.
---
 .../config/BasicSecurityConfiguration.java         | 14 +++-
 .../impl/CollectionCredentialResolver.java         |  2 +-
 .../xmlsec/AlgorithmPolicyConfiguration.java       |  5 +-
 .../opensaml/xmlsec/AlgorithmPolicyParameters.java | 13 ++--
 .../opensaml/xmlsec/EncryptionConfiguration.java   | 13 ++--
 .../org/opensaml/xmlsec/EncryptionParameters.java  | 15 ++--
 .../xmlsec/SignatureSigningConfiguration.java      |  7 +-
 .../agreement/KeyAgreementProcessorRegistry.java   |  4 +-
 .../xmlsec/agreement/KeyAgreementSupport.java      |  6 +-
 .../opensaml/xmlsec/agreement/package-info.java    |  5 +-
 .../xmlsec/algorithm/AlgorithmRegistry.java        |  6 +-
 .../algorithm/KeyLengthSpecifiedAlgorithm.java     |  4 +-
 .../descriptors/BlockEncryptionAES128CBC.java      |  2 +-
 .../descriptors/BlockEncryptionAES128GCM.java      |  2 +-
 .../descriptors/BlockEncryptionAES192CBC.java      |  2 +-
 .../descriptors/BlockEncryptionAES192GCM.java      |  2 +-
 .../descriptors/BlockEncryptionAES256CBC.java      |  2 +-
 .../descriptors/BlockEncryptionAES256GCM.java      |  2 +-
 .../descriptors/BlockEncryptionDESede.java         |  2 +-
 .../descriptors/SymmetricKeyWrapAES128.java        |  2 +-
 .../descriptors/SymmetricKeyWrapAES192.java        |  2 +-
 .../descriptors/SymmetricKeyWrapAES256.java        |  2 +-
 .../descriptors/SymmetricKeyWrapDESede.java        |  2 +-
 .../xmlsec/algorithm/descriptors/package-info.java |  5 +-
 .../opensaml/xmlsec/algorithm/package-info.java    |  5 +-
 .../config/BasicXMLSecurityConfiguration.java      | 28 ++++++-
 .../org/opensaml/xmlsec/config/package-info.java   |  5 +-
 .../org/opensaml/xmlsec/context/package-info.java  |  5 +-
 .../DecryptionConfigurationCriterion.java          | 16 ++--
 .../EncryptionConfigurationCriterion.java          | 16 ++--
 .../criterion/EncryptionOptionalCriterion.java     |  9 +--
 .../KeyInfoGenerationProfileCriterion.java         |  4 +-
 .../SignatureSigningConfigurationCriterion.java    | 18 ++---
 .../SignatureValidationConfigurationCriterion.java | 14 ++--
 .../opensaml/xmlsec/criterion/package-info.java    |  5 +-
 .../org/opensaml/xmlsec/crypto/package-info.java   |  5 +-
 .../xmlsec/derivation/KeyDerivationSupport.java    |  4 +-
 .../opensaml/xmlsec/derivation/package-info.java   |  5 +-
 .../opensaml/xmlsec/encryption/package-info.java   |  5 +-
 .../support/AbstractEncryptedKeyResolver.java      |  4 +-
 .../support/ChainingEncryptedKeyResolver.java      | 14 ++--
 .../support/DataEncryptionParameters.java          |  7 +-
 .../xmlsec/encryption/support/Decrypter.java       |  6 +-
 .../support/DefaultPreDecryptionValidator.java     |  2 -
 .../encryption/support/EncryptedKeyResolver.java   |  3 +-
 .../KeyAgreementEncryptionConfiguration.java       |  4 +-
 .../support/KeyEncryptionParameters.java           |  4 +-
 .../encryption/support/PreDecryptionValidator.java |  6 +-
 .../encryption/support/RSAOAEPParameters.java      | 24 +++---
 .../xmlsec/encryption/support/package-info.java    |  5 +-
 .../keyinfo/KeyInfoCredentialResolutionMode.java   |  9 +--
 .../opensaml/xmlsec/keyinfo/KeyInfoCriterion.java  |  8 +-
 .../opensaml/xmlsec/keyinfo/KeyInfoGenerator.java  |  2 +-
 .../xmlsec/keyinfo/KeyInfoGeneratorFactory.java    |  8 +-
 .../xmlsec/keyinfo/KeyInfoGeneratorManager.java    |  1 +
 .../opensaml/xmlsec/keyinfo/KeyInfoSupport.java    | 22 +++---
 .../keyinfo/NamedKeyInfoGeneratorManager.java      |  1 +
 .../org/opensaml/xmlsec/keyinfo/package-info.java  |  5 +-
 .../java/org/opensaml/xmlsec/package-info.java     |  5 +-
 .../opensaml/xmlsec/signature/package-info.java    |  5 +-
 .../xmlsec/signature/support/ContentReference.java |  2 +-
 .../signature/support/SignaturePrevalidator.java   |  2 +-
 .../xmlsec/signature/support/SignatureSupport.java |  7 +-
 .../signature/support/SignatureTrustEngine.java    |  4 +-
 .../SignatureValidationParametersCriterion.java    |  4 +-
 .../support/SignatureValidationProvider.java       |  2 +-
 .../signature/support/SignatureValidator.java      |  3 +-
 .../opensaml/xmlsec/signature/support/Signer.java  |  3 +-
 .../xmlsec/signature/support/SignerProvider.java   |  2 +-
 .../TransformsConfigurableContentReference.java    |  6 +-
 .../signature/support/URIContentReference.java     |  3 +-
 .../xmlsec/signature/support/package-info.java     |  5 +-
 .../impl/DHWithLegacyKDFKeyAgreementProcessor.java |  2 +-
 .../xmlsec/agreement/impl/DigestMethod.java        |  4 +-
 .../opensaml/xmlsec/agreement/impl/KANonce.java    |  4 +-
 .../impl/KeyAgreementParameterParser.java          |  2 +-
 .../impl/KeyAgreementParametersParser.java         |  4 +-
 .../opensaml/xmlsec/agreement/impl/KeySize.java    | 12 +--
 .../xmlsec/agreement/impl/package-info.java        |  5 +-
 .../config/impl/ApacheXMLSecurityInitializer.java  |  9 ++-
 .../impl/JavaCryptoValidationInitializer.java      |  7 +-
 .../opensaml/xmlsec/config/impl/package-info.java  |  5 +-
 .../opensaml/xmlsec/derivation/impl/ConcatKDF.java |  4 +-
 .../opensaml/xmlsec/derivation/impl/PBKDF2.java    |  2 +-
 .../xmlsec/derivation/impl/package-info.java       |  5 +-
 .../xmlsec/encryption/impl/package-info.java       |  5 +-
 .../impl/AbstractSecurityParametersResolver.java   | 13 ++--
 .../impl/AlgorithmRuntimeSupportedPredicate.java   |  7 +-
 .../impl/BasicAlgorithmPolicyConfiguration.java    |  5 +-
 .../xmlsec/impl/BasicDecryptionConfiguration.java  | 23 ++++--
 .../xmlsec/impl/BasicEncryptionConfiguration.java  | 85 ++++++++++++++++------
 .../impl/BasicSignatureSigningConfiguration.java   | 57 +++++++++++----
 .../BasicSignatureValidationConfiguration.java     |  8 +-
 .../xmlsec/impl/ExcludedAlgorithmsPredicate.java   |  5 +-
 .../xmlsec/impl/IncludedAlgorithmsPredicate.java   |  3 +-
 .../org/opensaml/xmlsec/impl/package-info.java     |  5 +-
 .../keyinfo/impl/BasicKeyInfoGeneratorFactory.java |  3 +-
 .../BasicProviderKeyInfoCredentialResolver.java    | 11 ++-
 .../impl/CollectionKeyInfoCredentialResolver.java  |  2 +-
 .../impl/KeyAgreementKeyInfoGeneratorFactory.java  |  4 +-
 .../xmlsec/keyinfo/impl/KeyInfoProvider.java       |  6 +-
 .../keyinfo/impl/KeyInfoResolutionContext.java     | 13 ++--
 .../impl/LocalKeyInfoCredentialResolver.java       |  2 +-
 .../keyinfo/impl/X509KeyInfoGeneratorFactory.java  |  6 +-
 .../opensaml/xmlsec/keyinfo/impl/package-info.java |  5 +-
 .../provider/AgreementMethodKeyInfoProvider.java   |  9 ++-
 .../impl/provider/DEREncodedKeyValueProvider.java  |  9 ++-
 .../keyinfo/impl/provider/DSAKeyValueProvider.java |  9 ++-
 .../keyinfo/impl/provider/ECKeyValueProvider.java  |  9 ++-
 .../impl/provider/InlineX509DataProvider.java      |  9 ++-
 .../impl/provider/KeyInfoReferenceProvider.java    |  9 ++-
 .../keyinfo/impl/provider/RSAKeyValueProvider.java |  9 ++-
 .../xmlsec/keyinfo/impl/provider/package-info.java |  5 +-
 .../support => messaging}/impl/package-info.java   |  7 +-
 .../xmlsec/signature/impl/package-info.java        |  5 +-
 .../impl/ChainingSignaturePrevalidator.java        |  3 +-
 .../signature/support/impl/package-info.java       |  5 +-
 ...heSantuarioSignatureValidationProviderImpl.java |  4 +-
 .../ApacheSantuarioSignerProviderImpl.java         |  4 +-
 .../support/impl/provider/package-info.java        |  5 +-
 .../xmlsec/derivation/impl/PBKDF2Test.java         | 12 +--
 .../derivation/tests/KeyDerivationSupportTest.java | 14 ++--
 .../AlgorithmRuntimeSupportedPredicateTest.java    |  7 +-
 123 files changed, 564 insertions(+), 356 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java
index 4c1f0a90d..a3c1ae540 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/config/BasicSecurityConfiguration.java
@@ -92,9 +92,14 @@ public class BasicSecurityConfiguration implements SecurityConfiguration {
      * Set the configuration used when validating client TLS X509Credentials.
      * 
      * @param config configuration used when validating client TLS X509Credentials, or null
+     * 
+     * @return this object
      */
-    public void setClientTLSValidationConfiguration(@Nullable final ClientTLSValidationConfiguration config) {
+    @Nonnull public BasicSecurityConfiguration setClientTLSValidationConfiguration(
+            @Nullable final ClientTLSValidationConfiguration config) {
         clientTLSConfig = config;
+        
+        return this;
     }
     
     /** {@inheritDoc} */
@@ -106,9 +111,14 @@ public class BasicSecurityConfiguration implements SecurityConfiguration {
      * Set the configuration used when executing HttpClient requests.
      * 
      * @param config configuration used when executing HttpClient requests, or null
+     * 
+     * @return this object
      */
-    public void setHttpClientSecurityConfiguration(@Nullable final HttpClientSecurityConfiguration config) {
+    @Nonnull public BasicSecurityConfiguration setHttpClientSecurityConfiguration(
+            @Nullable final HttpClientSecurityConfiguration config) {
         httpClientConfig = config;
+        
+        return this;
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
index e75d131b5..a3df28735 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
@@ -60,7 +60,7 @@ public class CollectionCredentialResolver extends AbstractCriteriaFilteringCrede
      *
      * @param credentials the credential collection which is the backing store for the resolver
      */
-    public CollectionCredentialResolver(@Nonnull final Collection<Credential> credentials) {
+    public CollectionCredentialResolver(@Nonnull @Live final Collection<Credential> credentials) {
         collection = credentials;
     }
     
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java
index 7fbe08b1c..e425ab3b7 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java
@@ -21,7 +21,6 @@ import java.util.Collection;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -44,7 +43,7 @@ public interface AlgorithmPolicyConfiguration {
      * 
      * @return the collection of algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive Collection<String> getIncludedAlgorithms();
+    @Nonnull @Unmodifiable @NotLive Collection<String> getIncludedAlgorithms();
     
     /**
      * Flag indicating whether to merge this configuration's includes with one of a lower order of precedence,
@@ -59,7 +58,7 @@ public interface AlgorithmPolicyConfiguration {
      * 
      * @return the collection of algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive Collection<String> getExcludedAlgorithms();
+    @Nonnull @Unmodifiable @NotLive Collection<String> getExcludedAlgorithms();
     
     /**
      * Flag indicating whether to merge this configuration's excludes with one of a lower order of precedence,
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java
index 8eec48efd..f7a46d9cb 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java
@@ -22,7 +22,6 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -34,10 +33,10 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class AlgorithmPolicyParameters {
     
     /** Included algorithm URIs. */
-    @Nonnull @NonnullElements private Collection<String> includedAlgorithmURIs;
+    @Nonnull private Collection<String> includedAlgorithmURIs;
     
     /** Excluded algorithm URIs. */
-    @Nonnull @NonnullElements private Collection<String> excludedAlgorithmURIs;
+    @Nonnull private Collection<String> excludedAlgorithmURIs;
         
     /** Constructor. */
     public AlgorithmPolicyParameters() {
@@ -50,7 +49,7 @@ public class AlgorithmPolicyParameters {
      * 
      * @return the included algorithms
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getIncludedAlgorithms() {
+    @Nonnull @NotLive @Unmodifiable public Collection<String> getIncludedAlgorithms() {
         return includedAlgorithmURIs;
     }
     
@@ -59,7 +58,7 @@ public class AlgorithmPolicyParameters {
      * 
      * @param uris the included algorithms
      */
-    public void setIncludedAlgorithms(@Nullable @NonnullElements final Collection<String> uris) {
+    public void setIncludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
             includedAlgorithmURIs = CollectionSupport.emptySet();
             return;
@@ -72,7 +71,7 @@ public class AlgorithmPolicyParameters {
      * 
      * @return the excluded algorithms
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getExcludedAlgorithms() {
+    @Nonnull @NotLive @Unmodifiable public Collection<String> getExcludedAlgorithms() {
         return excludedAlgorithmURIs;
     }
     
@@ -81,7 +80,7 @@ public class AlgorithmPolicyParameters {
      * 
      * @param uris the excluded algorithms
      */
-    public void setExcludedAlgorithms(@Nullable @NonnullElements final Collection<String> uris) {
+    public void setExcludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
             excludedAlgorithmURIs = CollectionSupport.emptySet();
             return;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java
index 2a082924a..b06f4e64b 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java
@@ -28,11 +28,9 @@ import org.opensaml.xmlsec.encryption.support.KeyAgreementEncryptionConfiguratio
 import org.opensaml.xmlsec.encryption.support.RSAOAEPParameters;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
-
 /**
  * The configuration information to use when generating encrypted XML.
  */
@@ -43,28 +41,28 @@ public interface EncryptionConfiguration extends AlgorithmPolicyConfiguration {
      * 
      * @return the list of encryption credentials, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<Credential> getDataEncryptionCredentials();
+    @Nonnull @Unmodifiable @NotLive List<Credential> getDataEncryptionCredentials();
     
     /**
      * Get the list of preferred data encryption algorithm URIs, in preference order.
      * 
      * @return the list of algorithm URIs, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<String> getDataEncryptionAlgorithms();
+    @Nonnull @Unmodifiable @NotLive List<String> getDataEncryptionAlgorithms();
     
     /**
      * Get the list of key transport encryption credentials to use, in preference order.
      * 
      * @return the list of encryption credentials, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<Credential> getKeyTransportEncryptionCredentials();
+    @Nonnull @Unmodifiable @NotLive List<Credential> getKeyTransportEncryptionCredentials();
     
     /**
      * Get the list of preferred key transport encryption algorithm URIs, in preference order.
      * 
      * @return the list of algorithm URIs, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<String> getKeyTransportEncryptionAlgorithms();
+    @Nonnull @Unmodifiable @NotLive List<String> getKeyTransportEncryptionAlgorithms();
 
     /**
      * Get the KeyInfoGenerator manager to use when generating the EncryptedData/KeyInfo.
@@ -107,7 +105,6 @@ public interface EncryptionConfiguration extends AlgorithmPolicyConfiguration {
      * 
      * @return the 
      */
-    @Nonnull @Unmodifiable @NotLive
-    Map<String, KeyAgreementEncryptionConfiguration> getKeyAgreementConfigurations();
+    @Nonnull @Unmodifiable @NotLive Map<String, KeyAgreementEncryptionConfiguration> getKeyAgreementConfigurations();
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionParameters.java
index 2d5f4457b..02e09c5a7 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionParameters.java
@@ -30,27 +30,26 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 public class EncryptionParameters {
     
     /** The EncryptedData encryption credential. */
-    private Credential dataEncryptionCredential;
+    @Nullable private Credential dataEncryptionCredential;
     
     /** The EncryptedKey encryption credential. */
-    private Credential keyTransportEncryptionCredential;
+    @Nullable private Credential keyTransportEncryptionCredential;
     
     /** The EncryptedData encryption algorithm URI. */
-    private String dataEncryptionAlgorithmURI;
+    @Nullable private String dataEncryptionAlgorithmURI;
     
     /** The EncryptedKey encryption algorithm URI. */
-    private String keyTransportEncryptionAlgorithmURI;
+    @Nullable private String keyTransportEncryptionAlgorithmURI;
     
     /** The EncryptedData KeyInfoGenerator. */
-    private KeyInfoGenerator dataKeyInfoGenerator;
+    @Nullable private KeyInfoGenerator dataKeyInfoGenerator;
     
     /** The EncryptedKey KeyInfoGenerator. */
-    private KeyInfoGenerator keyTransportKeyInfoGenerator;
+    @Nullable private KeyInfoGenerator keyTransportKeyInfoGenerator;
     
     /** RSA OAEP parameters. */
-    private RSAOAEPParameters rsaOAEPParameters;
+    @Nullable private RSAOAEPParameters rsaOAEPParameters;
 
-    
     /**
      * Get the encryption credential to use when encrypting the EncryptedData.
      * 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java
index 14fa77b09..354b58e3e 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -40,14 +39,14 @@ public interface SignatureSigningConfiguration extends AlgorithmPolicyConfigurat
      * 
      * @return the list of signing credentials, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<Credential> getSigningCredentials();
+    @Nonnull @Unmodifiable @NotLive List<Credential> getSigningCredentials();
     
     /**
      * Get the list of preferred signature algorithm URIs, in preference order.
      * 
      * @return the list of algorithm URIs, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<String> getSignatureAlgorithms();
+    @Nonnull @Unmodifiable @NotLive List<String> getSignatureAlgorithms();
     
     /**
      * Get the list of digest method algorithm URIs suitable for use as a Signature Reference DigestMethod value,
@@ -55,7 +54,7 @@ public interface SignatureSigningConfiguration extends AlgorithmPolicyConfigurat
      * 
      * @return a digest method algorithm URI
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive List<String> getSignatureReferenceDigestMethods();
+    @Nonnull @Unmodifiable @NotLive List<String> getSignatureReferenceDigestMethods();
     
     /**
      * Get a canonicalization algorithm URI suitable for use as a Signature Reference Transform value.
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessorRegistry.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessorRegistry.java
index 51a038a9f..96893ede5 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessorRegistry.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessorRegistry.java
@@ -24,7 +24,6 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -82,7 +81,8 @@ public class KeyAgreementProcessorRegistry {
      * 
      * @return the set of registered algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getRegisteredAlgorithms() {
+    @SuppressWarnings("null")
+    @Nonnull @Unmodifiable @NotLive public Set<String> getRegisteredAlgorithms() {
         return CollectionSupport.copyToSet(processors.keySet());
     }
     
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementSupport.java
index 19a9ccc00..7815b89ff 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementSupport.java
@@ -33,7 +33,6 @@ import org.opensaml.xmlsec.encryption.EncryptedType;
 import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.KeySize;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
@@ -42,7 +41,7 @@ import net.shibboleth.shared.collection.CollectionSupport;
 public final class KeyAgreementSupport {
     
     /** JCA key algorithms that support key agreement. */
-    @Nonnull @NonnullElements public static final Set<String> KEY_ALGORITHMS =
+    @Nonnull public static final Set<String> KEY_ALGORITHMS =
             CollectionSupport.setOf(JCAConstants.KEY_ALGO_EC, JCAConstants.KEY_ALGO_DH);
     
     /** Constructor. */
@@ -167,4 +166,5 @@ public final class KeyAgreementSupport {
         final PublicKey pk = credential.getPublicKey();
         return pk != null && KEY_ALGORITHMS.contains(pk.getAlgorithm());
     }
-}
+    
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/package-info.java
index 73bd4ecf8..1f806906c 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** API components related to key agreement operations. */
-package org.opensaml.xmlsec.agreement;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.agreement;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
index ab08e7ac1..252f8c008 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
@@ -34,7 +34,6 @@ import javax.crypto.KeyAgreement;
 import javax.crypto.Mac;
 import javax.crypto.NoSuchPaddingException;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -211,8 +210,7 @@ public class AlgorithmRegistry {
      *
      * @return the set of URIs for the given type, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive
-    public Set<String> getRegisteredURIsByType(@Nonnull final AlgorithmType type) {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getRegisteredURIsByType(@Nonnull final AlgorithmType type) {
         Constraint.isNotNull(type, "AlgorithmType was null");
         final Set<String> byType = types.get(type);
         if (byType != null) {
@@ -228,7 +226,7 @@ public class AlgorithmRegistry {
      *
      * @return the set of descriptors for the given type, may be empty
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive
+    @Nonnull @Unmodifiable @NotLive
     public Set<AlgorithmDescriptor> getRegisteredByType(@Nonnull final AlgorithmType type) {
         return getRegisteredURIsByType(type).stream()
                 .map(this::get)
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/KeyLengthSpecifiedAlgorithm.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/KeyLengthSpecifiedAlgorithm.java
index 246774b46..c8f1589d6 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/KeyLengthSpecifiedAlgorithm.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/KeyLengthSpecifiedAlgorithm.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.xmlsec.algorithm;
 
-import javax.annotation.Nonnull;
-
 /**
  * Interface for algorithm descriptors which specify a key length.
  */
@@ -29,6 +27,6 @@ public interface KeyLengthSpecifiedAlgorithm extends AlgorithmDescriptor {
      * 
      * @return the specified key length
      */
-    @Nonnull Integer getKeyLength();
+    int getKeyLength();
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128CBC.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128CBC.java
index 7f978cea3..6189febcd 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128CBC.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128CBC.java
@@ -49,7 +49,7 @@ public final class BlockEncryptionAES128CBC implements BlockEncryptionAlgorithm
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 128;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128GCM.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128GCM.java
index 2d181b5f0..a9e768fec 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128GCM.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES128GCM.java
@@ -49,7 +49,7 @@ public final class BlockEncryptionAES128GCM implements BlockEncryptionAlgorithm
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 128;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192CBC.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192CBC.java
index 246ee434c..c647d44c0 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192CBC.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192CBC.java
@@ -49,7 +49,7 @@ public final class BlockEncryptionAES192CBC implements BlockEncryptionAlgorithm
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 192;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192GCM.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192GCM.java
index d0fbd2d4f..80f86e246 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192GCM.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES192GCM.java
@@ -49,7 +49,7 @@ public final class BlockEncryptionAES192GCM implements BlockEncryptionAlgorithm
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 192;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256CBC.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256CBC.java
index 7d24217e1..13890f105 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256CBC.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256CBC.java
@@ -49,7 +49,7 @@ public final class BlockEncryptionAES256CBC implements BlockEncryptionAlgorithm
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 256;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256GCM.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256GCM.java
index ec5bd0722..5c5bc475e 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256GCM.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionAES256GCM.java
@@ -49,7 +49,7 @@ public final class BlockEncryptionAES256GCM implements BlockEncryptionAlgorithm
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 256;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionDESede.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionDESede.java
index d0ca73dce..c30755174 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionDESede.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/BlockEncryptionDESede.java
@@ -51,7 +51,7 @@ public final class BlockEncryptionDESede implements BlockEncryptionAlgorithm {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 192;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES128.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES128.java
index c0d4ab872..9dbdb92fb 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES128.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES128.java
@@ -49,7 +49,7 @@ public final class SymmetricKeyWrapAES128 implements SymmetricKeyWrapAlgorithm {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 128;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES192.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES192.java
index b9e15d22c..ff45c43ce 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES192.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES192.java
@@ -49,7 +49,7 @@ public final class SymmetricKeyWrapAES192 implements SymmetricKeyWrapAlgorithm {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 192;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES256.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES256.java
index 978a369d1..310e26ca8 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES256.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapAES256.java
@@ -49,7 +49,7 @@ public final class SymmetricKeyWrapAES256 implements SymmetricKeyWrapAlgorithm {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 256;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapDESede.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapDESede.java
index 6a76e94c8..af9633583 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapDESede.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SymmetricKeyWrapDESede.java
@@ -51,7 +51,7 @@ public final class SymmetricKeyWrapDESede implements SymmetricKeyWrapAlgorithm {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return 192;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/package-info.java
index 427439f19..0c695fadc 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Algorithm descriptor classes. */
-package org.opensaml.xmlsec.algorithm.descriptors;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/package-info.java
index 74864591d..d767d4537 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Configuration and support classes for security algorithms. */
-package org.opensaml.xmlsec.algorithm;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.algorithm;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java
index e54a59d59..669fba3be 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/BasicXMLSecurityConfiguration.java
@@ -76,9 +76,14 @@ public class BasicXMLSecurityConfiguration extends BasicSecurityConfiguration im
      * Set the configuration used when validating protocol message signatures.
      * 
      * @param config configuration used when validating protocol message signatures, or null
+     * 
+     * @return this object
      */
-    public void setSignatureValidationConfiguration(@Nullable final SignatureValidationConfiguration config) {
+    @Nonnull public BasicXMLSecurityConfiguration setSignatureValidationConfiguration(
+            @Nullable final SignatureValidationConfiguration config) {
         sigValidateConfig = config;
+        
+        return this;
     }
 
     /** {@inheritDoc} */
@@ -90,9 +95,14 @@ public class BasicXMLSecurityConfiguration extends BasicSecurityConfiguration im
      * Set the configuration used when generating protocol message signatures.
      * 
      * @param config configuration used when generating protocol message signatures, or null
+     * 
+     * @return this object
      */
-    public void setSignatureSigningConfiguration(@Nullable final SignatureSigningConfiguration config) {
+    @Nonnull public BasicXMLSecurityConfiguration setSignatureSigningConfiguration(
+            @Nullable final SignatureSigningConfiguration config) {
         sigSigningConfig = config;
+        
+        return this;
     }
 
     /** {@inheritDoc} */
@@ -104,9 +114,14 @@ public class BasicXMLSecurityConfiguration extends BasicSecurityConfiguration im
      * Set the configuration used when decrypting protocol message information.
      * 
      * @param config configuration used when decrypting protocol message information, or null
+     * 
+     * @return this object
      */
-    public void setDecryptionConfiguration(@Nullable final DecryptionConfiguration config) {
+    @Nonnull public BasicXMLSecurityConfiguration setDecryptionConfiguration(
+            @Nullable final DecryptionConfiguration config) {
         decryptConfig = config;
+        
+        return this;
     }
 
     /** {@inheritDoc} */
@@ -118,9 +133,14 @@ public class BasicXMLSecurityConfiguration extends BasicSecurityConfiguration im
      * Set the configuration used when encrypting protocol message information.
      * 
      * @param config configuration used when encrypting protocol message information, or null
+     * 
+     * @return this object
      */
-    public void setEncryptionConfiguration(@Nullable final EncryptionConfiguration config) {
+    @Nonnull public BasicXMLSecurityConfiguration setEncryptionConfiguration(@
+            Nullable final EncryptionConfiguration config) {
         encryptConfig = config;
+        
+        return this;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/package-info.java
index 0f90efc6f..74c0daddd 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/config/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** OpenSAML configuration classes. */
-package org.opensaml.xmlsec.config;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.config;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/context/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/context/package-info.java
index 5ef1136b5..02c9cb550 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/context/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/context/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Message context classes for XML Security. */
-package org.opensaml.xmlsec.context;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.context;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/DecryptionConfigurationCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/DecryptionConfigurationCriterion.java
index 03ecef98e..6487530aa 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/DecryptionConfigurationCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/DecryptionConfigurationCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -37,15 +36,14 @@ import org.opensaml.xmlsec.DecryptionConfiguration;
 public class DecryptionConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    @Nonnull @NonnullElements private List<DecryptionConfiguration> configs;
+    @Nonnull private List<DecryptionConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public DecryptionConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
-            List<DecryptionConfiguration> configurations) {
+    public DecryptionConfigurationCriterion(@Nonnull @NotEmpty final List<DecryptionConfiguration> configurations) {
         configs = CollectionSupport.copyToList(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -57,8 +55,7 @@ public class DecryptionConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public DecryptionConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
-            DecryptionConfiguration... configurations) {
+    public DecryptionConfigurationCriterion(@Nonnull @NotEmpty final DecryptionConfiguration... configurations) {
         configs = CollectionSupport.listOf(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -69,8 +66,7 @@ public class DecryptionConfigurationCriterion implements Criterion {
      * 
      * @return the list of configuration instances
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<DecryptionConfiguration> getConfigurations() {
+    @Nonnull @NotEmpty @NotLive @Unmodifiable public List<DecryptionConfiguration> getConfigurations() {
         return configs;
     }
     
@@ -101,8 +97,8 @@ public class DecryptionConfigurationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof DecryptionConfigurationCriterion) {
-            return configs.equals(((DecryptionConfigurationCriterion) obj).getConfigurations());
+        if (obj instanceof DecryptionConfigurationCriterion other) {
+            return configs.equals(other.getConfigurations());
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionConfigurationCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionConfigurationCriterion.java
index 7d3913ab0..460a0cbfd 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionConfigurationCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionConfigurationCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -37,15 +36,14 @@ import org.opensaml.xmlsec.EncryptionConfiguration;
 public class EncryptionConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    @Nonnull @NonnullElements private List<EncryptionConfiguration> configs;
+    @Nonnull private List<EncryptionConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public EncryptionConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
-            List<EncryptionConfiguration> configurations) {
+    public EncryptionConfigurationCriterion(@Nonnull @NotEmpty final List<EncryptionConfiguration> configurations) {
         configs = CollectionSupport.copyToList(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -57,8 +55,7 @@ public class EncryptionConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public EncryptionConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
-            EncryptionConfiguration... configurations) {
+    public EncryptionConfigurationCriterion(@Nonnull @NotEmpty final EncryptionConfiguration... configurations) {
         configs = CollectionSupport.listOf(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -68,8 +65,7 @@ public class EncryptionConfigurationCriterion implements Criterion {
      * Get the list of configuration instances.
      * @return the list of configuration instances
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<EncryptionConfiguration> getConfigurations() {
+    @Nonnull @NotEmpty @NotLive @Unmodifiable public List<EncryptionConfiguration> getConfigurations() {
         return configs;
     }
     
@@ -100,8 +96,8 @@ public class EncryptionConfigurationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof EncryptionConfigurationCriterion) {
-            return configs.equals(((EncryptionConfigurationCriterion) obj).getConfigurations());
+        if (obj instanceof EncryptionConfigurationCriterion other) {
+            return configs.equals(other.getConfigurations());
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionOptionalCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionOptionalCriterion.java
index b35402be7..80041c56c 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionOptionalCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/EncryptionOptionalCriterion.java
@@ -19,8 +19,6 @@ package org.opensaml.xmlsec.criterion;
 
 import java.util.Objects;
 
-import javax.annotation.Nonnull;
-
 import com.google.common.base.MoreObjects;
 
 import net.shibboleth.shared.resolver.Criterion;
@@ -33,13 +31,14 @@ import net.shibboleth.shared.resolver.Criterion;
 public class EncryptionOptionalCriterion implements Criterion {
     
     /** The encryptionOptional criterion value. */
-    @Nonnull private Boolean encryptionOptional;
+    private boolean encryptionOptional;
     
     /**
      * Constructor.
      */
+    @SuppressWarnings("null")
     public EncryptionOptionalCriterion() {
-        encryptionOptional = Boolean.FALSE;
+        encryptionOptional = false;
     }
     
     /**
@@ -62,7 +61,7 @@ public class EncryptionOptionalCriterion implements Criterion {
 
     /** {@inheritDoc} */
     public int hashCode() {
-        return encryptionOptional.hashCode();
+        return Boolean.valueOf(encryptionOptional).hashCode();
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/KeyInfoGenerationProfileCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/KeyInfoGenerationProfileCriterion.java
index 9dfb30080..6c6177fb9 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/KeyInfoGenerationProfileCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/KeyInfoGenerationProfileCriterion.java
@@ -79,8 +79,8 @@ public final class KeyInfoGenerationProfileCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof KeyInfoGenerationProfileCriterion) {
-            return name.equals(((KeyInfoGenerationProfileCriterion) obj).getName());
+        if (obj instanceof KeyInfoGenerationProfileCriterion other) {
+            return name.equals(other.getName());
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureSigningConfigurationCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureSigningConfigurationCriterion.java
index 2815c9058..c08c7d3c1 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureSigningConfigurationCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureSigningConfigurationCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -37,15 +36,15 @@ import org.opensaml.xmlsec.SignatureSigningConfiguration;
 public class SignatureSigningConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    @Nonnull @NonnullElements private List<SignatureSigningConfiguration> configs;
+    @Nonnull private List<SignatureSigningConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public SignatureSigningConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
-            List<SignatureSigningConfiguration> configurations) {
+    public SignatureSigningConfigurationCriterion(
+            @Nonnull @NotEmpty final List<SignatureSigningConfiguration> configurations) {
         configs = CollectionSupport.copyToList(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -57,8 +56,8 @@ public class SignatureSigningConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public SignatureSigningConfigurationCriterion(@Nonnull @NonnullElements  @NotEmpty final
-            SignatureSigningConfiguration... configurations) {
+    public SignatureSigningConfigurationCriterion(
+            @Nonnull @NotEmpty final SignatureSigningConfiguration... configurations) {
         configs = CollectionSupport.listOf(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -68,8 +67,7 @@ public class SignatureSigningConfigurationCriterion implements Criterion {
      * Get the list of configuration instances.
      * @return the list of configuration instances
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<SignatureSigningConfiguration> getConfigurations() {
+    @Nonnull @NotEmpty @NotLive @Unmodifiable public List<SignatureSigningConfiguration> getConfigurations() {
         return configs;
     }
     
@@ -100,8 +98,8 @@ public class SignatureSigningConfigurationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof SignatureSigningConfigurationCriterion) {
-            return configs.equals(((SignatureSigningConfigurationCriterion) obj).getConfigurations());
+        if (obj instanceof SignatureSigningConfigurationCriterion other) {
+            return configs.equals(other.getConfigurations());
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureValidationConfigurationCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureValidationConfigurationCriterion.java
index 084a4c04c..bfdf011d0 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureValidationConfigurationCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/SignatureValidationConfigurationCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -37,14 +36,14 @@ import org.opensaml.xmlsec.SignatureValidationConfiguration;
 public class SignatureValidationConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    @Nonnull @NonnullElements private List<SignatureValidationConfiguration> configs;
+    @Nonnull private List<SignatureValidationConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public SignatureValidationConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
+    public SignatureValidationConfigurationCriterion(@Nonnull @NotEmpty final
             List<SignatureValidationConfiguration> configurations) {
         configs = CollectionSupport.copyToList(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
@@ -57,7 +56,7 @@ public class SignatureValidationConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public SignatureValidationConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
+    public SignatureValidationConfigurationCriterion(@Nonnull @NotEmpty final
             SignatureValidationConfiguration... configurations) {
         configs = CollectionSupport.listOf(
                 Constraint.isNotNull(configurations, "List of configurations cannot be null"));
@@ -68,8 +67,7 @@ public class SignatureValidationConfigurationCriterion implements Criterion {
      * Get the list of configuration instances.
      * @return the list of configuration instances
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<SignatureValidationConfiguration> getConfigurations() {
+    @Nonnull @NotEmpty @NotLive @Unmodifiable public List<SignatureValidationConfiguration> getConfigurations() {
         return configs;
     }
     
@@ -100,8 +98,8 @@ public class SignatureValidationConfigurationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof SignatureValidationConfigurationCriterion) {
-            return configs.equals(((SignatureValidationConfigurationCriterion) obj).getConfigurations());
+        if (obj instanceof SignatureValidationConfigurationCriterion other) {
+            return configs.equals(other.getConfigurations());
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/package-info.java
index b2e0b53c3..c91eb32e7 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/criterion/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Criterion classes for XML Security. */
-package org.opensaml.xmlsec.criterion;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.criterion;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/package-info.java
index 5a3589724..ad5b13076 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/crypto/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Support classes for XML Security operations. */
-package org.opensaml.xmlsec.crypto;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.crypto;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivationSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivationSupport.java
index d87a1d2fe..a5681f34f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivationSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivationSupport.java
@@ -68,7 +68,7 @@ public final class KeyDerivationSupport {
      * 
      * @throws KeyDerivationException if algorithm and specified key lengths are not consistent
      */
-    @Nonnull public static Integer getEffectiveKeyLength(@Nonnull final String algorithmURI,
+    public static int getEffectiveKeyLength(@Nonnull final String algorithmURI,
             @Nullable final Integer specifiedKeyLength) throws KeyDerivationException {
         Constraint.isNotNull(algorithmURI, "Algorithm URI was null");
         
@@ -89,4 +89,4 @@ public final class KeyDerivationSupport {
         return algoKeyLength;
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/package-info.java
index 28e0a6f70..8679a01db 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** API components related to key derivation operations. */
-package org.opensaml.xmlsec.derivation;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.derivation;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/package-info.java
index 7005dbf7b..ebcec6825 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** XMLObject interfaces and helper classes for representing encrypted content and encrypting/decrypting content. */
-package org.opensaml.xmlsec.encryption;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.encryption;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/AbstractEncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/AbstractEncryptedKeyResolver.java
index 5252f2ab9..c65cbc640 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/AbstractEncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/AbstractEncryptedKeyResolver.java
@@ -23,7 +23,6 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -77,7 +76,7 @@ public abstract class AbstractEncryptedKeyResolver implements EncryptedKeyResolv
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getRecipients() {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getRecipients() {
         return recipients;
     }
     
@@ -161,4 +160,5 @@ public abstract class AbstractEncryptedKeyResolver implements EncryptedKeyResolv
         }
         return false;
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java
index d1ed885fd..6bf3679ba 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java
@@ -30,7 +30,6 @@ import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -44,7 +43,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class ChainingEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
 
     /** The list of resolvers which form the resolution chain. */
-    @Nonnull @NonnullElements private final List<EncryptedKeyResolver> resolvers;
+    @Nonnull private final List<EncryptedKeyResolver> resolvers;
 
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(ChainingEncryptedKeyResolver.class);
@@ -54,8 +53,7 @@ public class ChainingEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
      * 
      * @param encKeyResolvers the chain of encrypted key resolvers
      */
-    public ChainingEncryptedKeyResolver(
-            @Nonnull @NonnullElements @ParameterName(name="encKeyResolvers")
+    public ChainingEncryptedKeyResolver(@Nonnull @ParameterName(name="encKeyResolvers")
             final List<EncryptedKeyResolver> encKeyResolvers) {
         resolvers = CollectionSupport.copyToList(
                 Constraint.isNotNull(encKeyResolvers, "List of EncryptedKeyResolvers cannot be null"));
@@ -68,8 +66,7 @@ public class ChainingEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
      * @param recipients the set of recipients
      */
     public ChainingEncryptedKeyResolver(
-            @Nonnull @NonnullElements @ParameterName(name="encKeyResolvers")
-            final List<EncryptedKeyResolver> encKeyResolvers,
+            @Nonnull @ParameterName(name="encKeyResolvers") final List<EncryptedKeyResolver> encKeyResolvers,
             @Nullable @ParameterName(name="recipients") final Set<String> recipients) {
         super(recipients);
         resolvers = CollectionSupport.copyToList(
@@ -83,8 +80,7 @@ public class ChainingEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
      * @param recipient the recipient
      */
     public ChainingEncryptedKeyResolver(
-            @Nonnull @NonnullElements @ParameterName(name="encKeyResolvers")
-            final List<EncryptedKeyResolver> encKeyResolvers,
+            @Nonnull @ParameterName(name="encKeyResolvers") final List<EncryptedKeyResolver> encKeyResolvers,
             @Nullable @ParameterName(name="recipient") final String recipient) {
         this(encKeyResolvers, recipient != null ? CollectionSupport.singleton(recipient) : null);
     }
@@ -94,7 +90,7 @@ public class ChainingEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
      * 
      * @return a list of EncryptedKeyResolver instances
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<EncryptedKeyResolver> getResolverChain() {
+    @Nonnull @Unmodifiable @NotLive public List<EncryptedKeyResolver> getResolverChain() {
         return resolvers;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DataEncryptionParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DataEncryptionParameters.java
index 4a6817aad..5976c90a6 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DataEncryptionParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DataEncryptionParameters.java
@@ -32,14 +32,14 @@ import net.shibboleth.shared.logic.Constraint;
 public class DataEncryptionParameters {
 
     /** Credential used to encrypt. */
-    private Credential encryptionCredential;
+    @Nullable private Credential encryptionCredential;
 
     /** XML Encryption algorithm URI used to encrypt. */
-    private String algorithm;
+    @Nullable private String algorithm;
 
     /** Generator for dynamically generating a KeyInfo instance containing information
      * from the encryption credential. */
-    private KeyInfoGenerator keyInfoGenerator;
+    @Nullable private KeyInfoGenerator keyInfoGenerator;
 
     /**
      * Constructor.
@@ -118,4 +118,5 @@ public class DataEncryptionParameters {
     public void setKeyInfoGenerator(@Nullable final KeyInfoGenerator newKeyInfoGenerator) {
         keyInfoGenerator = newKeyInfoGenerator;
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
index 415414caf..a6719006d 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
@@ -187,15 +187,15 @@ import com.google.common.base.Strings;
  */
 public class Decrypter {
 
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(Decrypter.class);
+    
     /** ParserPool used in parsing decrypted data. */
     @Nonnull private final ParserPool parserPool;
 
     /** Unmarshaller factory, used in decryption of EncryptedData objects. */
     @Nonnull private final UnmarshallerFactory unmarshallerFactory;
 
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(Decrypter.class);
-
     /** Resolver for data encryption keys. */
     @Nullable private KeyInfoCredentialResolver resolver;
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DefaultPreDecryptionValidator.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DefaultPreDecryptionValidator.java
index 475cd46b1..1d1dcdb2a 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DefaultPreDecryptionValidator.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/DefaultPreDecryptionValidator.java
@@ -30,13 +30,11 @@ import org.opensaml.xmlsec.encryption.EncryptedType;
 public class DefaultPreDecryptionValidator implements PreDecryptionValidator {
 
     /** {@inheritDoc} */
-    @Override
     public void validate(@Nonnull final EncryptedData encryptedData) throws PreDecryptionValidationException {
         performCommonValidation(encryptedData);
     }
 
     /** {@inheritDoc} */
-    @Override
     public void validate(@Nonnull final EncryptedKey encryptedKey) throws PreDecryptionValidationException {
         performCommonValidation(encryptedKey);
     }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptedKeyResolver.java
index c3f580ae0..f94b757e2 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptedKeyResolver.java
@@ -24,7 +24,6 @@ import javax.annotation.Nonnull;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -52,6 +51,6 @@ public interface EncryptedKeyResolver {
      * 
      * @return the collection of  recipient criteria
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive Set<String> getRecipients();
+    @Nonnull @Unmodifiable @NotLive Set<String> getRecipients();
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyAgreementEncryptionConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyAgreementEncryptionConfiguration.java
index 28a39e4a6..ee70b77a0 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyAgreementEncryptionConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyAgreementEncryptionConfiguration.java
@@ -63,7 +63,7 @@ public class KeyAgreementEncryptionConfiguration {
      * 
      * <p>Note that null is a very significant return value here as the calling code
      * will skip nulls but pick the first non-null result, so an empty collection will
-     * circumvent key agreement.</p>
+     * circumvent key agreement. This does not imply nullable elements.</p>
      * 
      * @return the collection of parameters or null if none exist
      */
@@ -84,4 +84,4 @@ public class KeyAgreementEncryptionConfiguration {
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyEncryptionParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyEncryptionParameters.java
index e143e8f4e..efde240d3 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyEncryptionParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/KeyEncryptionParameters.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.logic.Constraint;
 public class KeyEncryptionParameters extends DataEncryptionParameters {
 
     /** Recipient of the key. */
-    private String recipient;
+    @Nullable private String recipient;
     
     /** RSA OAEP parameters. */
-    private RSAOAEPParameters rsaOAEPParameters;
+    @Nullable private RSAOAEPParameters rsaOAEPParameters;
 
     /**
      * Constructor.
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/PreDecryptionValidator.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/PreDecryptionValidator.java
index 58f484390..9c886748f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/PreDecryptionValidator.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/PreDecryptionValidator.java
@@ -34,7 +34,7 @@ public interface PreDecryptionValidator {
      * 
      * @throws PreDecryptionValidationException if the target fails validation
      */
-    public void validate(@Nonnull final EncryptedData encryptedData) throws PreDecryptionValidationException;
+    void validate(@Nonnull final EncryptedData encryptedData) throws PreDecryptionValidationException;
 
     /**
      * Validate an instance of {@link EncryptedKey}.
@@ -43,6 +43,6 @@ public interface PreDecryptionValidator {
      * 
      * @throws PreDecryptionValidationException if the target fails validation
      */
-    public void validate(@Nonnull final EncryptedKey encryptedKey) throws PreDecryptionValidationException;
+    void validate(@Nonnull final EncryptedKey encryptedKey) throws PreDecryptionValidationException;
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/RSAOAEPParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/RSAOAEPParameters.java
index 4b03cc8c9..2f55195b6 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/RSAOAEPParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/RSAOAEPParameters.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.support;
 
+import javax.annotation.Nullable;
+
 import net.shibboleth.shared.primitive.StringSupport;
 
 /**
@@ -25,13 +27,13 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class RSAOAEPParameters {
     
     /** Digest method algorithm URI. */
-    private String digestMethod;
+    @Nullable private String digestMethod;
     
     /** Mask generation function (MGF) algorithm URI. */
-    private String maskGenerationFunction;
+    @Nullable private String maskGenerationFunction;
     
     /** Base64-encoded OAEPParams value. */
-    private String oaepParams;
+    @Nullable private String oaepParams;
 
     /** Constructor. */
     public RSAOAEPParameters() { }
@@ -43,7 +45,7 @@ public class RSAOAEPParameters {
      * @param  mgf the mask generation function (MGF)
      * @param params the OAEPParms (base64-encoded)
      */
-    public RSAOAEPParameters(final String digest, final String mgf, final String params) {
+    public RSAOAEPParameters(@Nullable final String digest, @Nullable final String mgf, @Nullable final String params) {
         setDigestMethod(digest);
         setMaskGenerationFunction(mgf);
         setOAEPparams(params);
@@ -72,7 +74,7 @@ public class RSAOAEPParameters {
      * 
      * @return the digest method URI
      */
-    public String getDigestMethod() {
+    @Nullable public String getDigestMethod() {
         return digestMethod;
     }
 
@@ -81,7 +83,7 @@ public class RSAOAEPParameters {
      * 
      * @param value the new digest method URI
      */
-    public void setDigestMethod(final String value) {
+    public void setDigestMethod(@Nullable final String value) {
         digestMethod = StringSupport.trimOrNull(value);
     }
 
@@ -90,7 +92,7 @@ public class RSAOAEPParameters {
      * 
      * @return the MGF URI
      */
-    public String getMaskGenerationFunction() {
+    @Nullable public String getMaskGenerationFunction() {
         return maskGenerationFunction;
     }
 
@@ -99,7 +101,7 @@ public class RSAOAEPParameters {
      * 
      * @param value the new MGF algorithm URI
      */
-    public void setMaskGenerationFunction(final String value) {
+    public void setMaskGenerationFunction(@Nullable final String value) {
         maskGenerationFunction = StringSupport.trimOrNull(value);
     }
 
@@ -108,7 +110,7 @@ public class RSAOAEPParameters {
      * 
      * @return the base64-encoded OAEPParams
      */
-    public String getOAEPParams() {
+    @Nullable public String getOAEPParams() {
         return oaepParams;
     }
 
@@ -117,8 +119,8 @@ public class RSAOAEPParameters {
      * 
      * @param value the new base64-encoded OAEPParams value
      */
-    public void setOAEPparams(final String value) {
+    public void setOAEPparams(@Nullable final String value) {
         oaepParams = StringSupport.trimOrNull(value);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/package-info.java
index 0d2c6eb48..0c783951d 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Functional support for XML Encryption. */
-package org.opensaml.xmlsec.encryption.support;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.encryption.support;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCredentialResolutionMode.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCredentialResolutionMode.java
index 9c939f93c..5365b8a02 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCredentialResolutionMode.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCredentialResolutionMode.java
@@ -20,7 +20,6 @@ package org.opensaml.xmlsec.keyinfo;
 import java.security.PrivateKey;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
 import org.apache.xml.security.encryption.AgreementMethod;
@@ -80,7 +79,7 @@ public final class KeyInfoCredentialResolutionMode implements Criterion {
     }
     
     /** Resolution mode. */
-    private Mode mode;
+    @Nonnull private Mode mode;
     
     
     /**
@@ -97,7 +96,7 @@ public final class KeyInfoCredentialResolutionMode implements Criterion {
      * 
      * @return the resolution mode
      */
-    @Nullable public Mode getMode() {
+    @Nonnull public Mode getMode() {
         return mode;
     }
     
@@ -123,8 +122,8 @@ public final class KeyInfoCredentialResolutionMode implements Criterion {
             return false;
         }
 
-        if (obj instanceof KeyInfoCredentialResolutionMode) {
-            return mode.equals(((KeyInfoCredentialResolutionMode) obj).mode);
+        if (obj instanceof KeyInfoCredentialResolutionMode other) {
+            return mode.equals(other.mode);
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCriterion.java
index 8727b4640..476c4ee06 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoCriterion.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.keyinfo;
 
+import java.util.Objects;
+
 import javax.annotation.Nullable;
 
 import org.opensaml.xmlsec.signature.KeyInfo;
@@ -30,7 +32,7 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class KeyInfoCriterion implements Criterion {
     
     /** The KeyInfo which serves as the source for credential criteria. */
-    private KeyInfo keyInfo;
+    @Nullable private KeyInfo keyInfo;
     
     /**
      * Constructor.
@@ -89,8 +91,8 @@ public final class KeyInfoCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof KeyInfoCriterion) {
-            return keyInfo.equals(((KeyInfoCriterion) obj).keyInfo);
+        if (obj instanceof KeyInfoCriterion other) {
+            return Objects.equals(keyInfo, other.keyInfo);
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGenerator.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGenerator.java
index 3eddf8207..23b78632a 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGenerator.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGenerator.java
@@ -36,6 +36,6 @@ public interface KeyInfoGenerator {
      * @return a new KeyInfo object or null if nothing was generated
      * @throws SecurityException thrown if there is any error generating the new KeyInfo from the credential
      */
-    @Nullable public KeyInfo generate(@Nullable final Credential credential) throws SecurityException;
+    @Nullable KeyInfo generate(@Nullable final Credential credential) throws SecurityException;
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorFactory.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorFactory.java
index 11d581f68..b7978ab06 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorFactory.java
@@ -35,7 +35,7 @@ public interface KeyInfoGeneratorFactory {
      * 
      * @return a new KeyInfoGenerator instance
      */
-    @Nonnull public KeyInfoGenerator newInstance();
+    @Nonnull KeyInfoGenerator newInstance();
     
     /**
      * Get a new instance of the generator type produced by the factory, and which generates
@@ -46,7 +46,7 @@ public interface KeyInfoGeneratorFactory {
      * 
      * @return a new KeyInfoGenerator instance
      */
-    @Nonnull public default KeyInfoGenerator newInstance(@Nullable final Class<? extends KeyInfo> type) {
+    @Nonnull default KeyInfoGenerator newInstance(@Nullable final Class<? extends KeyInfo> type) {
         throw new UnsupportedOperationException("Method not implemented");
     }
     
@@ -57,7 +57,7 @@ public interface KeyInfoGeneratorFactory {
      * @return true if the generators produced by this factory can handle the type of the specified credential,
      *          false otherwise
      */
-    public boolean handles(@Nonnull final Credential credential);
+    boolean handles(@Nonnull final Credential credential);
     
     /**
      * Get the type (interface) of the specific type of credential handled by generators produced by
@@ -65,6 +65,6 @@ public interface KeyInfoGeneratorFactory {
      * 
      * @return the specifc type of credential handled by the generators produced by this factory
      */
-    @Nonnull public Class<? extends Credential> getCredentialType();
+    @Nonnull Class<? extends Credential> getCredentialType();
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java
index 1452b1061..f1d664b39 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java
@@ -67,6 +67,7 @@ public class KeyInfoGeneratorManager {
      * 
      * @return the collection of managed factories
      */
+    @SuppressWarnings("null")
     @Nonnull public Collection<KeyInfoGeneratorFactory> getFactories() {
         return CollectionSupport.copyToList(factories.values());
     }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
index 4c20ba189..456e84407 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
@@ -91,8 +91,9 @@ import org.slf4j.Logger;
 
 import com.google.common.base.Strings;
 
-import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.codec.EncodingException;
@@ -113,7 +114,7 @@ public final class KeyInfoSupport {
     /**
      * Factory for {@link java.security.cert.X509Certificate} and {@link java.security.cert.X509CRL} creation.
      */
-    private static CertificateFactory x509CertFactory;
+    @Nullable private static CertificateFactory x509CertFactory;
 
     /** Constructor. */
     private KeyInfoSupport() {
@@ -127,7 +128,7 @@ public final class KeyInfoSupport {
      * 
      * @return a list of key name strings
      */
-    @Nonnull public static List<String> getKeyNames(@Nullable final KeyInfo keyInfo) {
+    @Nonnull @Unmodifiable @NotLive public static List<String> getKeyNames(@Nullable final KeyInfo keyInfo) {
         final List<String> keynameList = new LinkedList<>();
 
         if (keyInfo == null) {
@@ -170,7 +171,7 @@ public final class KeyInfoSupport {
      * @throws CertificateException thrown if there is a problem converting the X509 data into
      *             {@link java.security.cert.X509Certificate}s.
      */
-    @Nonnull @Live public static List<X509Certificate> getCertificates(@Nullable final KeyInfo keyInfo)
+    @Nonnull @Unmodifiable @NotLive public static List<X509Certificate> getCertificates(@Nullable final KeyInfo keyInfo)
             throws CertificateException {
         final List<X509Certificate> certList = new LinkedList<>();
 
@@ -196,8 +197,8 @@ public final class KeyInfoSupport {
      * @throws CertificateException thrown if there is a problem converting the X509 data into
      *             {@link java.security.cert.X509Certificate}s.
      */
-    @Nonnull @Live public static List<X509Certificate> getCertificates(@Nullable final X509Data x509Data)
-            throws CertificateException {
+    @Nonnull @Unmodifiable @NotLive public static List<X509Certificate> getCertificates(
+            @Nullable final X509Data x509Data) throws CertificateException {
         final List<X509Certificate> certList = new LinkedList<>();
 
         if (x509Data == null) {
@@ -245,7 +246,8 @@ public final class KeyInfoSupport {
      * @throws CRLException thrown if there is a problem converting the CRL data into {@link java.security.cert.X509CRL}
      *             s
      */
-    @Nonnull public static List<X509CRL> getCRLs(@Nullable final KeyInfo keyInfo) throws CRLException {
+    @Nonnull @Unmodifiable @NotLive public static List<X509CRL> getCRLs(
+            @Nullable final KeyInfo keyInfo) throws CRLException {
         final List<X509CRL> crlList = new LinkedList<>();
 
         if (keyInfo == null) {
@@ -270,7 +272,8 @@ public final class KeyInfoSupport {
      * @throws CRLException thrown if there is a problem converting the CRL data into {@link java.security.cert.X509CRL}
      *             s
      */
-    @Nonnull public static List<X509CRL> getCRLs(@Nullable final X509Data x509Data) throws CRLException {
+    @Nonnull @Unmodifiable @NotLive public static List<X509CRL> getCRLs(
+            @Nullable final X509Data x509Data) throws CRLException {
         final List<X509CRL> crlList = new LinkedList<>();
 
         if (x509Data == null) {
@@ -372,8 +375,7 @@ public final class KeyInfoSupport {
      *             to the XMLObject representation
      */
     @Nonnull public static org.opensaml.xmlsec.signature.X509Certificate
-            buildX509Certificate(final X509Certificate cert)
-            throws CertificateEncodingException {
+            buildX509Certificate(final X509Certificate cert) throws CertificateEncodingException {
         Constraint.isNotNull(cert, "X.509 certificate cannot be null");
         
        
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java
index c7495e5df..13c307add 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java
@@ -73,6 +73,7 @@ public class NamedKeyInfoGeneratorManager {
      * 
      * @return the set of all manager names currently configured
      */
+    @SuppressWarnings("null")
     @Nonnull @Unmodifiable @NotLive public Set<String> getManagerNames() {
         return CollectionSupport.copyToSet(managers.keySet());
     }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/package-info.java
index 8d5a6b512..ded23182d 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Classes in support of processing XML Signature KeyInfo material. */
-package org.opensaml.xmlsec.keyinfo;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.keyinfo;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/package-info.java
index 4143bd423..a8aabd9c5 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Configuration and support classes for security. */
-package org.opensaml.xmlsec;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/package-info.java
index 28044a27c..f306c3358 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** XMLObject interfaces and helper classes for representing digitally signed content and signing/validating content. */
-package org.opensaml.xmlsec.signature;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.signature;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/ContentReference.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/ContentReference.java
index c49d2b8a7..f54f27697 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/ContentReference.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/ContentReference.java
@@ -34,5 +34,5 @@ public interface ContentReference {
      *
      * @param signature the signature object
      */
-    public void createReference(@Nonnull final XMLSignature signature);
+    void createReference(@Nonnull final XMLSignature signature);
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignaturePrevalidator.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignaturePrevalidator.java
index 6681b945b..bd746674f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignaturePrevalidator.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignaturePrevalidator.java
@@ -38,6 +38,6 @@ public interface SignaturePrevalidator {
      * @param signature the signature to evaluate
      * @throws SignatureException if the signature does not meet the validator's requirements
      */
-    public void validate(@Nonnull final Signature signature) throws SignatureException;
+    void validate(@Nonnull final Signature signature) throws SignatureException;
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureSupport.java
index c5a64552b..19bc3b76f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureSupport.java
@@ -37,7 +37,6 @@ import org.opensaml.xmlsec.signature.SignableXMLObject;
 import org.opensaml.xmlsec.signature.Signature;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -52,7 +51,7 @@ public final class SignatureSupport {
     @Nonnull private static final Logger LOG = LoggerFactory.getLogger(SignatureSupport.class);
     
     /** Set of known canonicalization algorithm URIs. */
-    @Nonnull @NonnullElements private static final Set<String> C14N_ALGORITHMS = CollectionSupport.setOf(
+    @Nonnull private static final Set<String> C14N_ALGORITHMS = CollectionSupport.setOf(
             SignatureConstants.ALGO_ID_C14N11_OMIT_COMMENTS,
             SignatureConstants.ALGO_ID_C14N11_WITH_COMMENTS,
             SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS,
@@ -154,7 +153,7 @@ public final class SignatureSupport {
      * @throws SecurityException thrown if a required parameter is not supplied in the parameters instance
      *          or available on the Signature instance
      */
-    private static void processKeyInfo(final Signature signature, 
+    private static void processKeyInfo(@Nonnull final Signature signature, 
             final SignatureSigningParameters parameters) throws SecurityException {
         
         if (signature.getKeyInfo() == null) {
@@ -294,4 +293,4 @@ public final class SignatureSupport {
         Signer.signObject(signature);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureTrustEngine.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureTrustEngine.java
index ef78308a6..49f7460d4 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureTrustEngine.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureTrustEngine.java
@@ -42,7 +42,7 @@ public interface SignatureTrustEngine extends TrustEngine<Signature> {
      * 
      * @return a KeyInfoCredentialResolver instance
      */
-    @Nullable public KeyInfoCredentialResolver getKeyInfoResolver();
+    @Nullable KeyInfoCredentialResolver getKeyInfoResolver();
 
     /**
      * Determines whether a raw signature over specified content is valid and signed by a trusted credential.
@@ -71,7 +71,7 @@ public interface SignatureTrustEngine extends TrustEngine<Signature> {
      * @throws SecurityException thrown if there is a problem attempting to verify the signature such as the signature
      *             algorithm not being supported
      */
-    public boolean validate(@Nonnull final byte[] signature, @Nonnull final byte[] content,
+    boolean validate(@Nonnull final byte[] signature, @Nonnull final byte[] content,
             @Nonnull final String algorithmURI, @Nullable final CriteriaSet trustBasisCriteria,
             @Nullable final Credential candidateCredential) throws SecurityException;
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationParametersCriterion.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationParametersCriterion.java
index f9c13ab1b..75c19c57e 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationParametersCriterion.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationParametersCriterion.java
@@ -81,8 +81,8 @@ public class SignatureValidationParametersCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof SignatureValidationParametersCriterion) {
-            return params.equals(((SignatureValidationParametersCriterion) obj).getSignatureValidationParameters());
+        if (obj instanceof SignatureValidationParametersCriterion other) {
+            return params.equals(other.getSignatureValidationParameters());
         }
 
         return false;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationProvider.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationProvider.java
index 6a3c3527f..338ae6fe2 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationProvider.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationProvider.java
@@ -47,7 +47,7 @@ public interface SignatureValidationProvider {
      * @throws SignatureException if the signature does not validate using the candiate Credential,
      *                              or if there is otherwise an error during the validation operation
      */
-    public void validate(@Nonnull final Signature signature, @Nonnull final Credential validationCredential) 
+    void validate(@Nonnull final Signature signature, @Nonnull final Credential validationCredential) 
             throws SignatureException;
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidator.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidator.java
index 323ae1919..9b6d179f9 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidator.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidator.java
@@ -21,6 +21,7 @@ import java.util.Iterator;
 import java.util.ServiceLoader;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.signature.Signature;
@@ -38,7 +39,7 @@ public final class SignatureValidator {
     @Nonnull private static final Logger LOG = LoggerFactory.getLogger(SignatureValidationProvider.class);
     
     /** The cached signature validation provider instance to use. */
-    private static SignatureValidationProvider validatorInstance;
+    @Nullable private static SignatureValidationProvider validatorInstance;
 
     /** Constructor. */
     protected SignatureValidator() { }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/Signer.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/Signer.java
index 12e714cce..240df894b 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/Signer.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/Signer.java
@@ -22,6 +22,7 @@ import java.util.List;
 import java.util.ServiceLoader;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.xmlsec.signature.Signature;
 import org.slf4j.Logger;
@@ -47,7 +48,7 @@ public final class Signer {
     @Nonnull private static final Logger LOG = LoggerFactory.getLogger(Signer.class);
     
     /** The cached signer provider instance to use. */
-    private static SignerProvider signerInstance;
+    @Nullable private static SignerProvider signerInstance;
 
     /** Constructor. */
     protected Signer() { }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignerProvider.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignerProvider.java
index 3b8e83a4e..3c513c820 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignerProvider.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignerProvider.java
@@ -43,6 +43,6 @@ public interface SignerProvider {
      * @param signature the signature to computer the signature on
      * @throws SignatureException thrown if there is an error computing the signature
      */
-    public void signObject(@Nonnull final Signature signature) throws SignatureException;
+    void signObject(@Nonnull final Signature signature) throws SignatureException;
 
 }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/TransformsConfigurableContentReference.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/TransformsConfigurableContentReference.java
index 67716d386..0b015a39d 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/TransformsConfigurableContentReference.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/TransformsConfigurableContentReference.java
@@ -19,6 +19,10 @@ package org.opensaml.xmlsec.signature.support;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
+import net.shibboleth.shared.annotation.constraint.Live;
+
 /**
  * A specialization of {@link ContentReference} which allows signature transforms to be specified.
  * 
@@ -33,6 +37,6 @@ public interface TransformsConfigurableContentReference extends ContentReference
      * 
      * @return the transforms applied to the content prior to digest generation
      */
-    public List<String> getTransforms();
+    @Nonnull @Live List<String> getTransforms();
  
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/URIContentReference.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/URIContentReference.java
index 82ec23277..f21b3463d 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/URIContentReference.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/URIContentReference.java
@@ -29,6 +29,7 @@ import org.apache.xml.security.transforms.TransformationException;
 import org.apache.xml.security.transforms.Transforms;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -71,7 +72,7 @@ public class URIContentReference implements ConfigurableContentReference, Transf
      * 
      * @return the transforms applied to the content prior to digest generation
      */
-    @Nonnull public List<String> getTransforms() {
+    @Nonnull @Live public List<String> getTransforms() {
         return transforms;
     }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/package-info.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/package-info.java
index 324edfdea..e72150543 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/package-info.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Functional support for XML Signature. */
-package org.opensaml.xmlsec.signature.support;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.signature.support;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java
index cf79d6a9f..44eb47d3b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java
@@ -109,7 +109,7 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
     }
 
     /** {@inheritDoc} */
-    @Nonnull protected SecretKey deriveSecretKey(final byte[] secret, @Nonnull final String keyAlgorithm,
+    @Nonnull protected SecretKey deriveSecretKey(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
         final KeySize keySizeParam = parameters.get(KeySize.class);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DigestMethod.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DigestMethod.java
index a7226263f..e8d080631 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DigestMethod.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DigestMethod.java
@@ -119,7 +119,7 @@ public class DigestMethod extends AbstractInitializableComponent
         }
 
         /** {@inheritDoc} */
-        public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
+        @Nonnull public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
             // Sanity check
             if (!handles(xmlObject)) {
                 throw new KeyAgreementException("This implementation does not handle: "
@@ -135,4 +135,4 @@ public class DigestMethod extends AbstractInitializableComponent
         
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java
index 5e2aa8493..361490274 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java
@@ -215,7 +215,7 @@ public class KANonce extends AbstractInitializableComponent
         }
 
         /** {@inheritDoc} */
-        public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
+        @Nonnull public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
             // Sanity check
             if (!handles(xmlObject)) {
                 throw new KeyAgreementException("This implementation does not handle: "
@@ -231,4 +231,4 @@ public class KANonce extends AbstractInitializableComponent
         
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParameterParser.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParameterParser.java
index a2689c3bb..a4a814341 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParameterParser.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParameterParser.java
@@ -46,6 +46,6 @@ public interface KeyAgreementParameterParser {
      * 
      * @throws KeyAgreementException if parameter parsing of the supplied object fails
      */
-    KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException;
+    @Nonnull KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException;
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java
index 2f818126b..631a2bf00 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java
@@ -31,6 +31,8 @@ import org.slf4j.Logger;
 
 import com.google.common.collect.Lists;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -105,7 +107,7 @@ public class KeyAgreementParametersParser {
      * 
      * @return the list of parser instances
      */
-    @Nonnull protected List<KeyAgreementParameterParser> getParsers() {
+    @Nonnull @Unmodifiable @NotLive protected List<KeyAgreementParameterParser> getParsers() {
         final ServiceLoader<KeyAgreementParameterParser> loader = ServiceLoader.load(KeyAgreementParameterParser.class);
         return Lists.newArrayList(loader);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeySize.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeySize.java
index 98bd8bccf..d85c06437 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeySize.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeySize.java
@@ -17,27 +17,23 @@
 
 package org.opensaml.xmlsec.agreement.impl;
 
-import javax.annotation.Nonnull;
-
 import org.opensaml.xmlsec.agreement.KeyAgreementParameter;
 
-import net.shibboleth.shared.logic.Constraint;
-
 /**
  * Key agreement parameter used to explicitly represent the size of the derived key.
  */
 public class KeySize implements KeyAgreementParameter {
     
     /** Key size. */
-    @Nonnull private Integer size;
+    private final int size;
     
     /**
      * Constructor.
      *
      * @param keySize the key size, in bits
      */
-    public KeySize(@Nonnull final Integer keySize) {
-        size = Constraint.isNotNull(keySize, "Specified key size was null");
+    public KeySize(final int keySize) {
+        size = keySize;
     }
     
     /**
@@ -45,7 +41,7 @@ public class KeySize implements KeyAgreementParameter {
      * 
      * @return the key size in bits
      */
-    @Nonnull public Integer getSize() {
+    public int getSize() {
        return size; 
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/package-info.java
index 1bc51d36f..e340ac3ae 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementation components related to key agreement operations. */
-package org.opensaml.xmlsec.agreement.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.agreement.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/ApacheXMLSecurityInitializer.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/ApacheXMLSecurityInitializer.java
index fc191fa7d..7b85a3bbe 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/ApacheXMLSecurityInitializer.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/ApacheXMLSecurityInitializer.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.config.impl;
 
+import javax.annotation.Nonnull;
+
 import org.apache.xml.security.Init;
 import org.opensaml.core.config.InitializationException;
 import org.opensaml.core.config.Initializer;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Initializer which initializes the Apache XML Security library (Santuario).
@@ -29,7 +32,7 @@ import org.slf4j.LoggerFactory;
 public class ApacheXMLSecurityInitializer implements Initializer {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(ApacheXMLSecurityInitializer.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(ApacheXMLSecurityInitializer.class);
 
     /** {@inheritDoc} */
     public void init() throws InitializationException {
@@ -46,4 +49,4 @@ public class ApacheXMLSecurityInitializer implements Initializer {
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/JavaCryptoValidationInitializer.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/JavaCryptoValidationInitializer.java
index 72791af20..3d7a03162 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/JavaCryptoValidationInitializer.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/JavaCryptoValidationInitializer.java
@@ -28,9 +28,9 @@ import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.core.config.InitializationException;
 import org.opensaml.core.config.Initializer;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An initializer which validates the Java Cryptographic Architecture environment is usable.
@@ -51,10 +51,11 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public class JavaCryptoValidationInitializer implements Initializer {
     
     /** Configuration property determining whether invalid result is fatal or not. */
-    @Nonnull @NotEmpty public static final String CONFIG_PROPERTY_FAIL_IS_FATAL = "opensaml.config.xmlsec.cryptoValidationIsFatal";
+    @Nonnull @NotEmpty public static final String CONFIG_PROPERTY_FAIL_IS_FATAL =
+            "opensaml.config.xmlsec.cryptoValidationIsFatal";
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(JavaCryptoValidationInitializer.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(JavaCryptoValidationInitializer.class);
 
     /** {@inheritDoc} */
     public void init() throws InitializationException {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/package-info.java
index 9a8380227..f3ffdeff1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Configuration and initialization of security. */
-package org.opensaml.xmlsec.config.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.config.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
index 3e62a9e9c..019bf119f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
@@ -548,7 +548,7 @@ public class ConcatKDF extends AbstractInitializableComponent
         }
 
         /** {@inheritDoc} */
-        public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
+        @Nonnull public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
             // Sanity check
             if (!handles(xmlObject)) {
                 throw new KeyAgreementException("This implementation does not handle: "
@@ -564,4 +564,4 @@ public class ConcatKDF extends AbstractInitializableComponent
         
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
index c02c8ff7f..839559336 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
@@ -516,7 +516,7 @@ public class PBKDF2 extends AbstractInitializableComponent
         }
 
         /** {@inheritDoc} */
-        public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
+        @Nonnull public KeyAgreementParameter parse(@Nonnull final XMLObject xmlObject) throws KeyAgreementException {
             // Sanity check
             if (!handles(xmlObject)) {
                 throw new KeyAgreementException("This implementation does not handle: "
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/package-info.java
index 9948bebe6..490665c4d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementation components related to key derivation operations. */
-package org.opensaml.xmlsec.derivation.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.derivation.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/package-info.java
index c38be7d81..91aac10bd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementations of the interfaces for XMLObjects that represent XML encryption types. */
-package org.opensaml.xmlsec.encryption.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.encryption.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
index 83c3bad7d..9efeadfd9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
@@ -25,7 +25,6 @@ import java.util.function.Predicate;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.logic.Constraint;
@@ -96,8 +95,8 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
      * @param configs the effective list of {@link AlgorithmPolicyConfiguration} instances to consider
      */
     protected void resolveAndPopulateIncludesExcludes(@Nonnull final AlgorithmPolicyParameters params, 
-            @Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
+            @Nonnull final CriteriaSet criteria,
+            @Nonnull @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         final Collection<String> includes = resolveEffectiveIncludes(criteria, configs);
         log.trace("Resolved effective includes: {}", includes);
@@ -150,7 +149,7 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
      * @return a predicate instance which operates accordingly to the effective include and exclude policy
      */
     @Nonnull protected Predicate<String> resolveIncludeExcludePredicate(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
+            @Nonnull @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         final Collection<String> includes = resolveEffectiveIncludes(criteria, configs);
         log.trace("Resolved effective includes: {}", includes);
@@ -199,7 +198,7 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
      * @return the effective algorithm excludes
      */
     @Nonnull protected Collection<String> resolveEffectiveExcludes(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
+            @Nonnull @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         final LazySet<String> accumulator = new LazySet<>();
         for (final AlgorithmPolicyConfiguration config : configs) {
@@ -220,7 +219,7 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
      * @return the effective algorithm includes
      */
     @Nonnull protected Collection<String> resolveEffectiveIncludes(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
+            @Nonnull @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         final LazySet<String> accumulator = new LazySet<>();
         for (final AlgorithmPolicyConfiguration config : configs) {
@@ -242,7 +241,7 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
      * @return the effective algorithm include/exclude precedence
      */
     @Nonnull protected Precedence resolveIncludeExcludePrecedence(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
+            @Nonnull @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         return configs.get(0).getIncludeExcludePrecedence();
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicate.java
index a7115201c..b2cfd3a05 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicate.java
@@ -19,6 +19,7 @@ package org.opensaml.xmlsec.impl;
 
 import java.util.function.Predicate;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
@@ -32,14 +33,14 @@ import net.shibboleth.shared.logic.Constraint;
 public class AlgorithmRuntimeSupportedPredicate implements Predicate<String> {
     
     /** The algorithm registry instance. */
-    private AlgorithmRegistry registry;
+    @Nonnull private AlgorithmRegistry registry;
     
     /**
      * Constructor.
      *
      * @param algorithmRegistry the algorithm registry instance to use
      */
-    public AlgorithmRuntimeSupportedPredicate(final AlgorithmRegistry algorithmRegistry) {
+    public AlgorithmRuntimeSupportedPredicate(@Nonnull final AlgorithmRegistry algorithmRegistry) {
         registry = Constraint.isNotNull(algorithmRegistry, "AlgorithmRegistry may not be null");
     }
 
@@ -48,4 +49,4 @@ public class AlgorithmRuntimeSupportedPredicate implements Predicate<String> {
         return registry.isRuntimeSupported(input);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
index 047314859..412b88b20 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
 
 import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -73,7 +72,7 @@ public class BasicAlgorithmPolicyConfiguration implements AlgorithmPolicyConfigu
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getIncludedAlgorithms() {
+    @Nonnull @NotLive @Unmodifiable public Collection<String> getIncludedAlgorithms() {
         return includes;
     }
     
@@ -112,7 +111,7 @@ public class BasicAlgorithmPolicyConfiguration implements AlgorithmPolicyConfigu
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getExcludedAlgorithms() {
+    @Nonnull @NotLive @Unmodifiable public Collection<String> getExcludedAlgorithms() {
         return excludes;
     }
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java
index de2bc276c..c7baac153 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.xmlsec.impl;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.xmlsec.DecryptionConfiguration;
@@ -53,9 +54,13 @@ public class BasicDecryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the KeyInfoCredentialResolver to use when processing the EncryptedData/KeyInfo.
      * 
      * @param resolver the KeyInfoCredentialResolver instance
+     * 
+     * @return this object
      */
-    public void setDataKeyInfoCredentialResolver(@Nullable final KeyInfoCredentialResolver resolver) {
+    @Nonnull public BasicDecryptionConfiguration setDataKeyInfoCredentialResolver(
+            @Nullable final KeyInfoCredentialResolver resolver) {
         dataKeyInfoCredentialResolver = resolver;
+        return this;
     }
     
     /**
@@ -73,9 +78,13 @@ public class BasicDecryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Key Encryption Key or KEK).
      * 
      * @param resolver the KeyInfoCredentialResolver instance
+     * 
+     * @return this object
      */
-    public void setKEKKeyInfoCredentialResolver(@Nullable final KeyInfoCredentialResolver resolver) {
-       kekKeyInfoCredentialResolver = resolver; 
+    @Nonnull public BasicDecryptionConfiguration setKEKKeyInfoCredentialResolver(
+            @Nullable final KeyInfoCredentialResolver resolver) {
+       kekKeyInfoCredentialResolver = resolver;
+       return this;
     }
     
     /**
@@ -91,9 +100,13 @@ public class BasicDecryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Get the EncryptedKeyResolver to use when resolving the EncryptedKey(s) to process.
      * 
      * @param resolver the EncryptedKeyResolver instance
+     * 
+     * @return this object
      */
-    public void setEncryptedKeyResolver(@Nullable final EncryptedKeyResolver resolver) {
-       encryptedKeyResolver = resolver; 
+    @Nonnull public BasicDecryptionConfiguration setEncryptedKeyResolver(
+            @Nullable final EncryptedKeyResolver resolver) {
+       encryptedKeyResolver = resolver;
+       return this;
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
index dee4cf6a5..d4f13d6ac 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
@@ -23,7 +23,6 @@ import java.util.Map;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -43,16 +42,16 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
         implements EncryptionConfiguration {
     
     /** Data encryption credentials. */
-    @Nonnull @NonnullElements private List<Credential> dataEncryptionCredentials;
+    @Nonnull private List<Credential> dataEncryptionCredentials;
     
     /** Data encryption algorithm URIs. */
-    @Nonnull @NonnullElements private List<String> dataEncryptionAlgorithms;
+    @Nonnull private List<String> dataEncryptionAlgorithms;
 
     /** Key transport encryption credentials. */
-    @Nonnull @NonnullElements private List<Credential> keyTransportEncryptionCredentials;
+    @Nonnull private List<Credential> keyTransportEncryptionCredentials;
     
     /** Key transport encryption algorithm URIs. */
-    @Nonnull @NonnullElements private List<String> keyTransportEncryptionAlgorithms;
+    @Nonnull private List<String> keyTransportEncryptionAlgorithms;
     
     /** Manager for named KeyInfoGenerator instances for encrypting data. */
     @Nullable private NamedKeyInfoGeneratorManager dataKeyInfoGeneratorManager;
@@ -70,7 +69,7 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
     @Nullable private KeyTransportAlgorithmPredicate keyTransportPredicate;
     
     /** Key agreement configurations. */
-    @Nonnull @NonnullElements private Map<String, KeyAgreementEncryptionConfiguration> keyAgreementConfigurations;
+    @Nonnull private Map<String, KeyAgreementEncryptionConfiguration> keyAgreementConfigurations;
     
     //TODO chaining to parent config instance on getters? or use a wrapping proxy, etc?
     
@@ -89,7 +88,7 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Credential> getDataEncryptionCredentials() {
+    @Nonnull @Unmodifiable @NotLive public List<Credential> getDataEncryptionCredentials() {
         return dataEncryptionCredentials;
     }
     
@@ -97,18 +96,23 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the data encryption credentials to use.
      * 
      * @param credentials the list of data encryption credentials
+     * 
+     * @return this object
      */
-    public void setDataEncryptionCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
+    @Nonnull public BasicEncryptionConfiguration setDataEncryptionCredentials(
+            @Nullable final List<Credential> credentials) {
         if (credentials == null) {
             dataEncryptionCredentials  = CollectionSupport.emptyList();
         } else {
             dataEncryptionCredentials = CollectionSupport.copyToList(credentials);
         }
+        
+        return this;
     }
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getDataEncryptionAlgorithms() {
+    @Nonnull @Unmodifiable @NotLive public List<String> getDataEncryptionAlgorithms() {
         return dataEncryptionAlgorithms;
     }
     
@@ -116,19 +120,24 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the data encryption algorithms to use.
      * 
      * @param algorithms the list of algorithms
+     * 
+     * @return this object
      */
-    public void setDataEncryptionAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
+    @Nonnull public BasicEncryptionConfiguration setDataEncryptionAlgorithms(
+            @Nullable final List<String> algorithms) {
         if (algorithms == null) {
             dataEncryptionAlgorithms = CollectionSupport.emptyList();
         } else {
             dataEncryptionAlgorithms =
                     CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
+        
+        return this;
     }
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Credential> getKeyTransportEncryptionCredentials() {
+    @Nonnull @Unmodifiable @NotLive public List<Credential> getKeyTransportEncryptionCredentials() {
         return keyTransportEncryptionCredentials;
     }
     
@@ -136,18 +145,23 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the key transport encryption credentials to use.
      * 
      * @param credentials the list of key transport encryption credentials
+     * 
+     * @return this object
      */
-    public void setKeyTransportEncryptionCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
+    @Nonnull public BasicEncryptionConfiguration setKeyTransportEncryptionCredentials(
+            @Nullable final List<Credential> credentials) {
         if (credentials == null) {
             keyTransportEncryptionCredentials  = CollectionSupport.emptyList();
         } else {
             keyTransportEncryptionCredentials = CollectionSupport.copyToList(credentials);
         }
+        
+        return this;
     }
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getKeyTransportEncryptionAlgorithms() {
+    @Nonnull @Unmodifiable @NotLive public List<String> getKeyTransportEncryptionAlgorithms() {
         return keyTransportEncryptionAlgorithms;
     }
     
@@ -155,14 +169,19 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the key transport encryption algorithms to use.
      * 
      * @param algorithms the list of algorithms
+     * 
+     * @return this object
      */
-    public void setKeyTransportEncryptionAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
+    @Nonnull public BasicEncryptionConfiguration setKeyTransportEncryptionAlgorithms(
+            @Nullable final List<String> algorithms) {
         if (algorithms == null) {
             keyTransportEncryptionAlgorithms = CollectionSupport.emptyList();
         } else {
             keyTransportEncryptionAlgorithms =
                     CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
+        
+        return this;
     }
     
     /** {@inheritDoc} */
@@ -175,9 +194,13 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the manager for named KeyInfoGenerator instances encrypting data.
      * 
      * @param keyInfoManager the KeyInfoGenerator manager to use
+     * 
+     * @return this object
      */
-    public void setDataKeyInfoGeneratorManager(@Nullable final NamedKeyInfoGeneratorManager keyInfoManager) {
+    @Nonnull public BasicEncryptionConfiguration setDataKeyInfoGeneratorManager(
+            @Nullable final NamedKeyInfoGeneratorManager keyInfoManager) {
         dataKeyInfoGeneratorManager = keyInfoManager;
+        return this;
     }
     
     /** {@inheritDoc} */
@@ -190,9 +213,13 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the manager for named KeyInfoGenerator instances for encrypting keys.
      * 
      * @param keyInfoManager the KeyInfoGenerator manager to use
+     * 
+     * @return this object
      */
-    public void setKeyTransportKeyInfoGeneratorManager(@Nullable final NamedKeyInfoGeneratorManager keyInfoManager) {
+    @Nonnull public BasicEncryptionConfiguration setKeyTransportKeyInfoGeneratorManager(
+            @Nullable final NamedKeyInfoGeneratorManager keyInfoManager) {
         keyTransportKeyInfoGeneratorManager = keyInfoManager;
+        return this;
     }
     
     /** {@inheritDoc} */
@@ -205,9 +232,12 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the instance of {@link RSAOAEPParameters}.
      * 
      * @param params the new parameters instance
+     * 
+     * @return this object
      */
-    public void setRSAOAEPParameters(@Nullable final RSAOAEPParameters params) {
+    @Nonnull public BasicEncryptionConfiguration setRSAOAEPParameters(@Nullable final RSAOAEPParameters params) {
         rsaOAEPParameters = params;
+        return this;
     }
     
     /** {@inheritDoc}.
@@ -226,9 +256,12 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * <p>Defaults to: <code>true</code>
      * 
      * @param flag true if should merge, false otherwise
+     * 
+     * @return this object
      */
-    public void setRSAOAEPParametersMerge(final boolean flag) {
+    @Nonnull public BasicEncryptionConfiguration setRSAOAEPParametersMerge(final boolean flag) {
         rsaOAEPParametersMerge = flag;
+        return this;
     }
     
     /** {@inheritDoc} */
@@ -241,13 +274,18 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the instance of {@link KeyTransportAlgorithmPredicate}.
      * 
      * @param predicate the new predicate instance
+     * 
+     * @return this object
      */
-    public void setKeyTransportAlgorithmPredicate(final KeyTransportAlgorithmPredicate predicate) {
+    @Nonnull public BasicEncryptionConfiguration setKeyTransportAlgorithmPredicate(
+            @Nullable final KeyTransportAlgorithmPredicate predicate) {
         keyTransportPredicate = predicate;
+        return this;
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Map<String, KeyAgreementEncryptionConfiguration> getKeyAgreementConfigurations() {
+    @Nonnull @Unmodifiable @NotLive
+    public Map<String, KeyAgreementEncryptionConfiguration> getKeyAgreementConfigurations() {
         return keyAgreementConfigurations;
     }
     
@@ -255,13 +293,18 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      * Set the map of {@link KeyAgreementEncryptionConfiguration} instances.
      * 
      * @param configs the new map of instances
+     * 
+     * @return this object
      */
-    public void setKeyAgreementConfigurations(@Nullable final Map<String,KeyAgreementEncryptionConfiguration> configs) {
+    @Nonnull public BasicEncryptionConfiguration setKeyAgreementConfigurations(
+            @Nullable final Map<String,KeyAgreementEncryptionConfiguration> configs) {
         if (configs == null) {
             keyAgreementConfigurations = CollectionSupport.emptyMap();
         } else {
             keyAgreementConfigurations = CollectionSupport.copyToMap(configs);
         }
+        
+        return this;
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
index fb72eb9a6..86d87a475 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
@@ -22,7 +22,6 @@ import java.util.List;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -39,13 +38,13 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
         implements SignatureSigningConfiguration {
     
     /** Signing credentials. */
-    @Nonnull @NonnullElements private List<Credential> signingCredentials;
+    @Nonnull private List<Credential> signingCredentials;
     
     /** Signature method algorithm URIs. */
-    @Nonnull @NonnullElements private List<String> signatureAlgorithms;
+    @Nonnull private List<String> signatureAlgorithms;
     
     /** Digest method algorithm URIs. */
-    @Nonnull @NonnullElements private List<String> signatureReferenceDigestMethods;
+    @Nonnull private List<String> signatureReferenceDigestMethods;
     
     /** The signature reference canonicalization transform algorithm. */
     @Nullable private String signatureReferenceCanonicalizationAlgorithm;
@@ -72,7 +71,7 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Credential> getSigningCredentials() {
+    @Nonnull @Unmodifiable @NotLive public List<Credential> getSigningCredentials() {
         return signingCredentials;
     }
     
@@ -80,18 +79,23 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * Set the signing credentials to use when signing.
      * 
      * @param credentials the list of signing credentials
+     * 
+     * @return this object
      */
-    public void setSigningCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
+    @Nonnull public BasicSignatureSigningConfiguration setSigningCredentials(
+            @Nullable final List<Credential> credentials) {
         if (credentials == null) {
             signingCredentials = CollectionSupport.emptyList();
         } else {
             signingCredentials = CollectionSupport.copyToList(credentials);
         }
+        
+        return this;
     }
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getSignatureAlgorithms() {
+    @Nonnull @Unmodifiable @NotLive public List<String> getSignatureAlgorithms() {
         return signatureAlgorithms;
     }
     
@@ -99,18 +103,22 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * Set the signature algorithms to use when signing.
      * 
      * @param algorithms the list of signature algorithms
+     * 
+     * @return this object
      */
-    public void setSignatureAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
+    @Nonnull public BasicSignatureSigningConfiguration setSignatureAlgorithms(@Nullable final List<String> algorithms) {
         if (algorithms == null) {
             signatureAlgorithms = CollectionSupport.emptyList();
         } else {
             signatureAlgorithms = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
+        
+        return this;
     }
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getSignatureReferenceDigestMethods() {
+    @Nonnull @Unmodifiable @NotLive public List<String> getSignatureReferenceDigestMethods() {
         return signatureReferenceDigestMethods;
     }
     
@@ -118,14 +126,19 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * Set a digest method algorithm URI suitable for use as a Signature Reference DigestMethod value.
      * 
      * @param algorithms a list of digest method algorithm URIs
+     * 
+     * @return this object
      */
-    public void setSignatureReferenceDigestMethods(@Nullable @NonnullElements final List<String> algorithms) {
+    @Nonnull public BasicSignatureSigningConfiguration setSignatureReferenceDigestMethods(
+            @Nullable final List<String> algorithms) {
         if (algorithms == null) {
             signatureReferenceDigestMethods = CollectionSupport.emptyList();
         } else {
             signatureReferenceDigestMethods =
                     CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
+        
+        return this;
     }
     
     /**
@@ -142,9 +155,13 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * Get a canonicalization algorithm URI suitable for use as a Signature Reference Transform value.
      * 
      * @param uri a canonicalization algorithm URI
+     * 
+     * @return this object
      */
-    public void setSignatureReferenceCanonicalizationAlgorithm(@Nullable final String uri) {
+    @Nonnull public BasicSignatureSigningConfiguration setSignatureReferenceCanonicalizationAlgorithm(
+            @Nullable final String uri) {
         signatureReferenceCanonicalizationAlgorithm = StringSupport.trimOrNull(uri);
+        return this;
     }
 
     /** {@inheritDoc} */
@@ -157,9 +174,13 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * Set a canonicalization algorithm URI suitable for use as a Signature CanonicalizationMethod value.
      * 
      * @param algorithmURI a canonicalization algorithm URI
+     * 
+     * @return this object
      */
-    public void setSignatureCanonicalizationAlgorithm(@Nullable final String algorithmURI) {
+    @Nonnull public BasicSignatureSigningConfiguration setSignatureCanonicalizationAlgorithm(
+            @Nullable final String algorithmURI) {
         signatureCanonicalization = StringSupport.trimOrNull(algorithmURI);
+        return this;
     }
 
     /** {@inheritDoc} */
@@ -173,9 +194,13 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * only when signing with an HMAC algorithm.  This value is optional when using HMAC.
      * 
      * @param length the HMAC output length value to use when performing HMAC signing (may be null)
+     * 
+     * @return this object
      */
-    public void setSignatureHMACOutputLength(@Nullable final Integer length) {
+    @Nonnull public BasicSignatureSigningConfiguration setSignatureHMACOutputLength(
+            @Nullable final Integer length) {
         signatureHMACOutputLength = length;
+        return this;
     }
     
     /** {@inheritDoc} */
@@ -188,9 +213,13 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      * Set the manager for named KeyInfoGenerator instances.
      * 
      * @param keyInfoManager the KeyInfoGenerator manager to use
+     * 
+     * @return this object
      */
-    public void setKeyInfoGeneratorManager(@Nullable final NamedKeyInfoGeneratorManager keyInfoManager) {
+    @Nonnull public BasicSignatureSigningConfiguration setKeyInfoGeneratorManager(
+            @Nullable final NamedKeyInfoGeneratorManager keyInfoManager) {
         keyInfoGeneratorManager = keyInfoManager;
+        return this;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java
index cef1f91f7..bd6508fb3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.xmlsec.impl;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.xmlsec.SignatureValidationConfiguration;
@@ -46,9 +47,14 @@ public class BasicSignatureValidationConfiguration extends BasicAlgorithmPolicyC
      * Set the signature trust engine to use.
      * 
      * @param engine the signature trust engine
+     * 
+     * @return this object
      */
-    public void setSignatureTrustEngine(@Nullable final SignatureTrustEngine engine) {
+    @Nonnull public BasicSignatureValidationConfiguration setSignatureTrustEngine(
+            @Nullable final SignatureTrustEngine engine) {
         signatureTrustEngine = engine;
+        
+        return this;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
index 40748cc79..2545abeb5 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
@@ -23,7 +23,6 @@ import java.util.function.Predicate;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -33,14 +32,14 @@ import net.shibboleth.shared.logic.Constraint;
 public class ExcludedAlgorithmsPredicate implements Predicate<String> {
     
     /** Excluded algorithms. */
-    @Nonnull @NonnullElements private Collection<String> excludes;
+    @Nonnull private Collection<String> excludes;
     
     /**
      * Constructor.
      *
      * @param algorithms collection of excluded algorithms
      */
-    public ExcludedAlgorithmsPredicate(@Nonnull @NonnullElements final Collection<String> algorithms) {
+    public ExcludedAlgorithmsPredicate(@Nonnull final Collection<String> algorithms) {
         excludes = CollectionSupport.copyToSet(Constraint.isNotNull(algorithms, "Exclusions may not be null"));
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
index 89418c687..c6d05f4fe 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
@@ -23,7 +23,6 @@ import java.util.function.Predicate;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -34,7 +33,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class IncludedAlgorithmsPredicate implements Predicate<String> {
     
     /** Included algorithms. */
-    @Nonnull @NonnullElements private Collection<String> includes;
+    @Nonnull private Collection<String> includes;
     
     /**
      * Constructor.
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/package-info.java
index 66d0c93b9..b5cccfc90 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementation of configuration and parameter resolver classes. */
-package org.opensaml.xmlsec.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java
index cb39d13fe..3842269c8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java
@@ -54,7 +54,8 @@ import net.shibboleth.shared.codec.EncodingException;
 public class BasicKeyInfoGeneratorFactory implements KeyInfoGeneratorFactory {
     
     /** Mappings from KeyInfo Class to QNames.*/
-    private static final Map<Class<? extends KeyInfo>, QName> CLASS_TO_NAME;
+    @Nonnull private static final Map<Class<? extends KeyInfo>, QName> CLASS_TO_NAME;
+    
     static {
         CLASS_TO_NAME = new HashMap<>();
         CLASS_TO_NAME.put(KeyInfo.class, KeyInfo.DEFAULT_ELEMENT_NAME);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java
index 6d163f2cd..550f01974 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java
@@ -47,6 +47,10 @@ import org.opensaml.xmlsec.signature.KeyValue;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -121,8 +125,9 @@ public class BasicProviderKeyInfoCredentialResolver extends AbstractCriteriaFilt
      */
     public BasicProviderKeyInfoCredentialResolver(
             @Nonnull @ParameterName(name="keyInfoProviders") final List<KeyInfoProvider> keyInfoProviders) {
-        providers = new ArrayList<>();
-        providers.addAll(keyInfoProviders);
+        Constraint.isNotNull(keyInfoProviders, "KeyInfoProviders cannot be null");
+        
+        providers = CollectionSupport.copyToList(keyInfoProviders);
     }
 
     /**
@@ -130,7 +135,7 @@ public class BasicProviderKeyInfoCredentialResolver extends AbstractCriteriaFilt
      * 
      * @return the list of providers configured for this resolver instance
      */
-    @Nonnull protected List<KeyInfoProvider> getProviders() {
+    @Nonnull @Unmodifiable @NotLive protected List<KeyInfoProvider> getProviders() {
         return providers;
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/CollectionKeyInfoCredentialResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/CollectionKeyInfoCredentialResolver.java
index 97b9f9ee8..6d4465db1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/CollectionKeyInfoCredentialResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/CollectionKeyInfoCredentialResolver.java
@@ -80,7 +80,7 @@ public class CollectionKeyInfoCredentialResolver extends CollectionCredentialRes
      *
      */
     public CollectionKeyInfoCredentialResolver() {
-        this(new ArrayList<Credential>());
+        this(new ArrayList<>());
     }
     
     /**
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java
index 2feda4bb6..df53dab9e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java
@@ -167,10 +167,10 @@ public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFa
         @Nonnull private final Logger log = LoggerFactory.getLogger(KeyAgreementKeyInfoGenerator.class);
         
         /** The set of options to be used by the generator.*/
-        private KeyAgreementOptions options;
+        @Nonnull private final KeyAgreementOptions options;
        
         /** Builder for AgreementMethod objects. */
-        private final XMLObjectBuilder<AgreementMethod> agreementMethodBuilder;
+        @Nonnull private final XMLObjectBuilder<AgreementMethod> agreementMethodBuilder;
        
         /**
          * Constructor.
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoProvider.java
index 8e4b988ba..607a0448f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoProvider.java
@@ -27,6 +27,8 @@ import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 /**
@@ -48,7 +50,7 @@ public interface KeyInfoProvider {
      * @throws SecurityException if there is an error during credential resolution.  
      *          Note: failure to resolve a credential is not an error.
      */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
+    @Nullable @Unmodifiable @NotLive Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
             @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
             @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException;
     
@@ -63,6 +65,6 @@ public interface KeyInfoProvider {
      * 
      * @return true if the provider should attempt to resolve credentials, false otherwise
      */
-    public boolean handles(@Nonnull final XMLObject keyInfoChild);
+    boolean handles(@Nonnull final XMLObject keyInfoChild);
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java
index d80a27a4d..64e505726 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java
@@ -29,6 +29,9 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyMap;
 import net.shibboleth.shared.collection.LazySet;
@@ -55,7 +58,7 @@ public class KeyInfoResolutionContext {
      * These may have for example been extracted from KeyName elements present,
      * or may have been inferred from the context in which the KeyInfo exists or
      * is being used. */
-    @Nonnull private final Set<String> keyNames;
+    @Nonnull @Live private final Set<String> keyNames;
     
     /** Get the key currently known to be represented by the KeyInfo. */
     @Nullable private Key key;
@@ -65,7 +68,7 @@ public class KeyInfoResolutionContext {
     @Nonnull private final Collection<Credential> resolvedCredentials;
     
     /** Extensible map of properties used to share state amongst providers and/or resolver logic. */
-    @Nonnull private final Map<String, Object> properties;
+    @Nonnull @Live private final Map<String, Object> properties;
     
     /**
      * Constructor.
@@ -109,7 +112,7 @@ public class KeyInfoResolutionContext {
      * @return the set of key names
      * 
      * */
-    @Nonnull public Set<String> getKeyNames() {
+    @Nonnull @Live public Set<String> getKeyNames() {
         return keyNames;
     }
     
@@ -137,7 +140,7 @@ public class KeyInfoResolutionContext {
      * 
      * @return Returns the keyValueCredential.
      */
-    @Nonnull public Collection<Credential> getResolvedCredentials() {
+    @Nonnull @Unmodifiable @NotLive public Collection<Credential> getResolvedCredentials() {
         return resolvedCredentials;
     }
     
@@ -146,7 +149,7 @@ public class KeyInfoResolutionContext {
      * 
      * @return Returns the properties.
      */
-    @Nonnull public Map<String, Object> getProperties() {
+    @Nonnull @Live public Map<String, Object> getProperties() {
         return properties;
     }
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java
index 8b1dfdf8d..7dcdf289a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java
@@ -88,7 +88,7 @@ public class LocalKeyInfoCredentialResolver extends BasicProviderKeyInfoCredenti
      */
     public LocalKeyInfoCredentialResolver(
             @Nonnull @ParameterName(name="keyInfoProviders") final List<KeyInfoProvider> keyInfoProviders,
-            @Nonnull  @ParameterName(name="localCredentialResolver") final CredentialResolver localCredentialResolver) {
+            @Nonnull @ParameterName(name="localCredentialResolver") final CredentialResolver localCredentialResolver) {
         super(keyInfoProviders);
         
         localCredResolver = Constraint.isNotNull(localCredentialResolver, "Local credential resolver cannot be null");
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java
index ace912af8..b8b7f17d6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java
@@ -759,7 +759,7 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
        private boolean emitX509Digest;
        
        /** X509Digest digest algorithm URI. */
-       private String x509DigestAlgorithmURI;
+       @Nonnull private String x509DigestAlgorithmURI;
        
        /** Emit the entity certificate subject DN as a KeyName element. */
        private boolean emitSubjectDNAsKeyName;
@@ -771,13 +771,13 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
        private boolean emitSubjectAltNamesAsKeyNames;
        
        /** The set of types of subject alternative names to process. */
-       private Set<Integer> subjectAltNames;
+       @Nonnull private Set<Integer> subjectAltNames;
        
        /**
         * Responsible for parsing and serializing X.500 names to/from
         * {@link javax.security.auth.x500.X500Principal} instances.
         */
-       private X500DNHandler x500DNHandler;
+       @Nonnull private X500DNHandler x500DNHandler;
        
        /** The format specifier for outputting X.500 subject names. */
        private String x500SubjectDNFormat;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/package-info.java
index a55fc5a69..01c721bf4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/package-info.java
@@ -19,4 +19,7 @@
  * Interfaces and classes for working with XML KeyInfo elements.  These classes are generally used to
  * extract or resolve credential information.
  */
-package org.opensaml.xmlsec.keyinfo.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.keyinfo.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java
index 68347a8a1..9b000ffd8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java
@@ -47,6 +47,8 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -92,9 +94,10 @@ public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
         
         // Sanity check
         if (!handles(keyInfoChild)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java
index 4c934630f..dda936672 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java
@@ -24,6 +24,8 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -54,9 +56,10 @@ public class DEREncodedKeyValueProvider extends AbstractKeyInfoProvider {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
 
         final DEREncodedKeyValue keyValue = getDEREncodedKeyValue(keyInfoChild);
         if (keyValue == null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DSAKeyValueProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DSAKeyValueProvider.java
index 862231ef6..03d31778e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DSAKeyValueProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DSAKeyValueProvider.java
@@ -24,6 +24,8 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -55,9 +57,10 @@ public class DSAKeyValueProvider extends AbstractKeyInfoProvider {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
         
         final DSAKeyValue keyValue = getDSAKeyValue(keyInfoChild);
         if (keyValue == null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/ECKeyValueProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/ECKeyValueProvider.java
index 3006eb90f..7406334cc 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/ECKeyValueProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/ECKeyValueProvider.java
@@ -38,6 +38,8 @@ import org.opensaml.xmlsec.signature.KeyValue;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -55,9 +57,10 @@ public class ECKeyValueProvider extends AbstractKeyInfoProvider {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
 
         final ECKeyValue keyValue = getECKeyValue(keyInfoChild);
         if (keyValue == null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java
index 123a38f0c..2336d4956 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java
@@ -31,6 +31,8 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.security.auth.x500.X500Principal;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.collection.LazySet;
@@ -113,9 +115,10 @@ public class InlineX509DataProvider extends AbstractKeyInfoProvider {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
 
         if (!handles(keyInfoChild)) {
             return null;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java
index b8c94902d..d14f5f1c7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java
@@ -33,6 +33,8 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.KeyInfoReference;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.Criterion;
@@ -56,9 +58,10 @@ public class KeyInfoReferenceProvider extends AbstractKeyInfoProvider {
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
 
         final KeyInfoReference ref = getKeyInfoReference(keyInfoChild);
         final String refURI = ref != null ? ref.getURI() : null;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java
index 6cd4f59de..0ac3be448 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java
@@ -24,6 +24,8 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -55,9 +57,10 @@ public class RSAKeyValueProvider extends AbstractKeyInfoProvider {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
-            @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
-            @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
+    @Nullable @Unmodifiable @NotLive public Collection<Credential> process(
+            @Nonnull final KeyInfoCredentialResolver resolver, @Nonnull final XMLObject keyInfoChild,
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final KeyInfoResolutionContext kiContext)
+                    throws SecurityException {
 
         final RSAKeyValue keyValue = getRSAKeyValue(keyInfoChild);
         if (keyValue == null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/package-info.java
index 38df8bcbc..1d0609cb6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/package-info.java
@@ -22,4 +22,7 @@
  * {@link org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver}, extract typed credential
  * information from a KeyInfo object.</p>
  */
-package org.opensaml.xmlsec.keyinfo.impl.provider;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.keyinfo.impl.provider;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/package-info.java
similarity index 82%
copy from opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java
copy to opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/package-info.java
index 3b89de9b6..78c181f1c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/package-info.java
@@ -16,6 +16,9 @@
  */
 
 /**
- * Implementations of signature evaluation functions.
+ * Message handlers for XML Security functionality.
  */
-package org.opensaml.xmlsec.signature.support.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.messaging.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/package-info.java
index 7623a1a98..0d2e83ff0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementations of the interfaces for XMLObjects that represent XML signature types. */
-package org.opensaml.xmlsec.signature.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.signature.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java
index 6ddea5558..72b901a12 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java
@@ -22,7 +22,6 @@ import java.util.List;
 import javax.annotation.Nonnull;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -41,7 +40,7 @@ public class ChainingSignaturePrevalidator implements SignaturePrevalidator {
     @Nonnull private Logger log = LoggerFactory.getLogger(ChainingSignaturePrevalidator.class);
     
     /** The chain of SignaturePrevalidator instances to execute. */
-    @Nonnull @NonnullElements private List<SignaturePrevalidator> validators;
+    @Nonnull private List<SignaturePrevalidator> validators;
     
     /**
      * Constructor.
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java
index 3b89de9b6..f6e2d0bd0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementations of signature evaluation functions.
  */
-package org.opensaml.xmlsec.signature.support.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.signature.support.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignatureValidationProviderImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignatureValidationProviderImpl.java
index bb9bd1060..32f25bc4e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignatureValidationProviderImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignatureValidationProviderImpl.java
@@ -31,9 +31,9 @@ import org.opensaml.xmlsec.signature.impl.SignatureImpl;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignatureValidationProvider;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Implementation of {@link SignatureValidationProvider} which is based on the Apache Santuario library
@@ -42,7 +42,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class ApacheSantuarioSignatureValidationProviderImpl implements SignatureValidationProvider {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ApacheSantuarioSignatureValidationProviderImpl.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ApacheSantuarioSignatureValidationProviderImpl.class);
 
     /** {@inheritDoc} */
     public void validate(@Nonnull final Signature signature, @Nonnull final Credential validationCredential) 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java
index 1045c05ca..4dbfca1e4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java
@@ -29,9 +29,9 @@ import org.opensaml.xmlsec.signature.impl.SignatureImpl;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignerProvider;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Implementation of {@link SignerProvider} which is based on the Apache Santuario library
@@ -40,7 +40,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class ApacheSantuarioSignerProviderImpl implements SignerProvider {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(ApacheSantuarioSignerProviderImpl.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(ApacheSantuarioSignerProviderImpl.class);
 
     /** {@inheritDoc} */
     public void signObject(@Nonnull final Signature signature) throws SignatureException {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/package-info.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/package-info.java
index a271a4ef4..3f2a5adb0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/package-info.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Provides Santuario-specific implementation of signing and validation. */
-package org.opensaml.xmlsec.signature.support.impl.provider;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.xmlsec.signature.support.impl.provider;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
index f20ff6238..5d5d2ac19 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
@@ -573,7 +573,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         }
 
         /** {@inheritDoc} */
-        @Nonnull public Integer getKeyLength() {
+        public int getKeyLength() {
             // 16 bytes
             return 128;
         }
@@ -613,7 +613,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         }
 
         /** {@inheritDoc} */
-        @Nonnull public Integer getKeyLength() {
+        public int getKeyLength() {
             // 20 bytes
             return 160;
         }
@@ -653,7 +653,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         }
 
         /** {@inheritDoc} */
-        @Nonnull public Integer getKeyLength() {
+        public int getKeyLength() {
             // 25 bytes
             return 200;
         }
@@ -693,7 +693,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         }
 
         /** {@inheritDoc} */
-        @Nonnull public Integer getKeyLength() {
+        public int getKeyLength() {
             // 32 bytes
             return 256;
         }
@@ -733,7 +733,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         }
 
         /** {@inheritDoc} */
-        @Nonnull public Integer getKeyLength() {
+        public int getKeyLength() {
             // 40 bytes
             return 320;
         }
@@ -760,4 +760,4 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java
index fcb779783..fca07539d 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java
@@ -50,22 +50,22 @@ public class KeyDerivationSupportTest extends OpenSAMLInitBaseTestCase {
     @Test
     public void getEffectiveKeyLength() throws Exception {
         Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength(
-                EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, null).intValue(), 128);
+                EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, null), 128);
         Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength(
-                EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, 128).intValue(), 128);
+                EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, 128), 128);
         
         Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength(
-                EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES, null).intValue(), 192);
+                EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES, null), 192);
         Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength(
-                EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES, 192).intValue(), 192);
+                EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES, 192), 192);
         
         Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength(
-                EncryptionConstants.ALGO_ID_KEYWRAP_AES128, null).intValue(), 128);
+                EncryptionConstants.ALGO_ID_KEYWRAP_AES128, null), 128);
         Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength(
-                EncryptionConstants.ALGO_ID_KEYWRAP_AES128, 128).intValue(), 128);
+                EncryptionConstants.ALGO_ID_KEYWRAP_AES128, 128), 128);
         
         // Non-length algorithm with non-null specified length should succeed as specified length
-        Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength("SomeAlgo", 128).intValue(), 128);
+        Assert.assertEquals(KeyDerivationSupport.getEffectiveKeyLength("SomeAlgo", 128), 128);
         
         try {
             KeyDerivationSupport.getEffectiveKeyLength(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM, 256);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicateTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicateTest.java
index 4224923fd..ea9acd153 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicateTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicateTest.java
@@ -52,8 +52,7 @@ public class AlgorithmRuntimeSupportedPredicateTest extends OpenSAMLInitBaseTest
     
     @BeforeMethod
     public void setUp() {
-        AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
-        Assert.assertNotNull(registry);
+        final AlgorithmRegistry registry = AlgorithmSupport.ensureGlobalAlgorithmRegistry();
         predicate = new AlgorithmRuntimeSupportedPredicate(registry);
     }
     
@@ -64,7 +63,7 @@ public class AlgorithmRuntimeSupportedPredicateTest extends OpenSAMLInitBaseTest
         if (loadBC) {
             providerSupport.loadBC();
             new GlobalAlgorithmRegistryInitializer().init();
-            predicate = new AlgorithmRuntimeSupportedPredicate(AlgorithmSupport.getGlobalAlgorithmRegistry());
+            predicate = new AlgorithmRuntimeSupportedPredicate(AlgorithmSupport.ensureGlobalAlgorithmRegistry());
         }
         
         try {
@@ -99,7 +98,7 @@ public class AlgorithmRuntimeSupportedPredicateTest extends OpenSAMLInitBaseTest
         if (loadBC) {
             providerSupport.loadBC();
             new GlobalAlgorithmRegistryInitializer().init();
-            predicate = new AlgorithmRuntimeSupportedPredicate(AlgorithmSupport.getGlobalAlgorithmRegistry());
+            predicate = new AlgorithmRuntimeSupportedPredicate(AlgorithmSupport.ensureGlobalAlgorithmRegistry());
         }
         
         try {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list