[java-opensaml] branch main updated: IDP-2069 - Null Handling Task

Scott Cantor cantor.2 at osu.edu
Fri Mar 31 15:45:15 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=cff8a21e40ac1f50ae1bfc56c84825f8ef9d4694

The following commit(s) were added to refs/heads/main by this push:
     new cff8a21e4 IDP-2069 - Null Handling Task
cff8a21e4 is described below

commit cff8a21e40ac1f50ae1bfc56c84825f8ef9d4694
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Mar 31 11:45:12 2023 -0400

    IDP-2069 - Null Handling Task
    
    https://shibboleth.atlassian.net/browse/IDP-2069
    
    Annotations and cleanup of Sig/Enc XMLObject impls.
---
 .../encryption/impl/AgreementMethodBuilder.java    |  20 ++--
 .../encryption/impl/AgreementMethodImpl.java       |  48 ++++++----
 .../encryption/impl/AgreementMethodMarshaller.java |   5 +-
 .../impl/AgreementMethodUnmarshaller.java          |   9 +-
 .../impl/AlgorithmIdentifierTypeImpl.java          |  12 ++-
 .../impl/AlgorithmIdentifierTypeMarshaller.java    |   5 +-
 .../impl/AlgorithmIdentifierTypeUnmarshaller.java  |   8 +-
 .../encryption/impl/CarriedKeyNameBuilder.java     |  16 ++--
 .../xmlsec/encryption/impl/CarriedKeyNameImpl.java |   9 +-
 .../xmlsec/encryption/impl/CipherDataBuilder.java  |  14 +--
 .../xmlsec/encryption/impl/CipherDataImpl.java     |  41 ++++----
 .../encryption/impl/CipherDataUnmarshaller.java    |   6 +-
 .../encryption/impl/CipherReferenceBuilder.java    |  18 ++--
 .../encryption/impl/CipherReferenceImpl.java       |  48 +++++-----
 .../encryption/impl/CipherReferenceMarshaller.java |   5 +-
 .../impl/CipherReferenceUnmarshaller.java          |   9 +-
 .../xmlsec/encryption/impl/CipherValueBuilder.java |  16 ++--
 .../xmlsec/encryption/impl/CipherValueImpl.java    |   8 +-
 .../encryption/impl/ConcatKDFParamsBuilder.java    |  17 ++--
 .../encryption/impl/ConcatKDFParamsImpl.java       |   7 +-
 .../encryption/impl/ConcatKDFParamsMarshaller.java |   5 +-
 .../impl/ConcatKDFParamsUnmarshaller.java          |   9 +-
 .../xmlsec/encryption/impl/DHKeyValueBuilder.java  |  14 +--
 .../xmlsec/encryption/impl/DHKeyValueImpl.java     |  81 ++++++++--------
 .../encryption/impl/DHKeyValueUnmarshaller.java    |   6 +-
 .../encryption/impl/DataReferenceBuilder.java      |  16 ++--
 .../xmlsec/encryption/impl/DataReferenceImpl.java  |   9 +-
 .../xmlsec/encryption/impl/DerivedKeyBuilder.java  |  16 ++--
 .../xmlsec/encryption/impl/DerivedKeyImpl.java     |   7 +-
 .../encryption/impl/DerivedKeyMarshaller.java      |   7 +-
 .../encryption/impl/DerivedKeyNameBuilder.java     |  16 ++--
 .../xmlsec/encryption/impl/DerivedKeyNameImpl.java |   9 +-
 .../encryption/impl/DerivedKeyUnmarshaller.java    |   9 +-
 .../encryption/impl/EncryptedDataBuilder.java      |  16 ++--
 .../xmlsec/encryption/impl/EncryptedDataImpl.java  |   9 +-
 .../encryption/impl/EncryptedKeyBuilder.java       |  16 ++--
 .../xmlsec/encryption/impl/EncryptedKeyImpl.java   |  51 +++++-----
 .../encryption/impl/EncryptedKeyMarshaller.java    |   9 +-
 .../encryption/impl/EncryptedKeyUnmarshaller.java  |  13 ++-
 .../xmlsec/encryption/impl/EncryptedTypeImpl.java  | 106 +++++++++++----------
 .../encryption/impl/EncryptedTypeMarshaller.java   |   7 +-
 .../encryption/impl/EncryptedTypeUnmarshaller.java |   9 +-
 .../encryption/impl/EncryptionMethodBuilder.java   |  18 ++--
 .../encryption/impl/EncryptionMethodImpl.java      |  48 +++++-----
 .../impl/EncryptionMethodMarshaller.java           |   5 +-
 .../impl/EncryptionMethodUnmarshaller.java         |   9 +-
 .../impl/EncryptionPropertiesBuilder.java          |  20 ++--
 .../encryption/impl/EncryptionPropertiesImpl.java  |  46 +++++----
 .../impl/EncryptionPropertiesMarshaller.java       |   7 +-
 .../impl/EncryptionPropertiesUnmarshaller.java     |   9 +-
 .../encryption/impl/EncryptionPropertyBuilder.java |  17 ++--
 .../encryption/impl/EncryptionPropertyImpl.java    |  66 ++++++-------
 .../impl/EncryptionPropertyMarshaller.java         |   9 +-
 .../xmlsec/encryption/impl/GeneratorBuilder.java   |  19 ++--
 .../xmlsec/encryption/impl/GeneratorImpl.java      |   8 +-
 .../encryption/impl/IterationCountBuilder.java     |  16 ++--
 .../xmlsec/encryption/impl/IterationCountImpl.java |   9 +-
 .../xmlsec/encryption/impl/KANonceBuilder.java     |  16 ++--
 .../xmlsec/encryption/impl/KANonceImpl.java        |   8 +-
 .../impl/KeyDerivationMethodBuilder.java           |  17 ++--
 .../encryption/impl/KeyDerivationMethodImpl.java   |  34 +++----
 .../impl/KeyDerivationMethodMarshaller.java        |   7 +-
 .../impl/KeyDerivationMethodUnmarshaller.java      |   9 +-
 .../xmlsec/encryption/impl/KeyLengthBuilder.java   |  16 ++--
 .../xmlsec/encryption/impl/KeyLengthImpl.java      |   9 +-
 .../encryption/impl/KeyReferenceBuilder.java       |  16 ++--
 .../xmlsec/encryption/impl/KeyReferenceImpl.java   |   6 +-
 .../xmlsec/encryption/impl/KeySizeBuilder.java     |  16 ++--
 .../xmlsec/encryption/impl/KeySizeImpl.java        |   8 +-
 .../xmlsec/encryption/impl/MGFBuilder.java         |  16 ++--
 .../opensaml/xmlsec/encryption/impl/MGFImpl.java   |   8 +-
 .../encryption/impl/MasterKeyNameBuilder.java      |  16 ++--
 .../xmlsec/encryption/impl/MasterKeyNameImpl.java  |   9 +-
 .../xmlsec/encryption/impl/OAEPparamsBuilder.java  |  16 ++--
 .../xmlsec/encryption/impl/OAEPparamsImpl.java     |   8 +-
 .../encryption/impl/OriginatorKeyInfoBuilder.java  |  17 ++--
 .../encryption/impl/OriginatorKeyInfoImpl.java     |   9 +-
 .../xmlsec/encryption/impl/OtherSourceBuilder.java |  19 ++--
 .../xmlsec/encryption/impl/OtherSourceImpl.java    |   8 +-
 .../encryption/impl/PBKDF2ParamsBuilder.java       |  16 ++--
 .../xmlsec/encryption/impl/PBKDF2ParamsImpl.java   |   6 +-
 .../encryption/impl/PBKDF2ParamsUnmarshaller.java  |   8 +-
 .../opensaml/xmlsec/encryption/impl/PBuilder.java  |  16 ++--
 .../org/opensaml/xmlsec/encryption/impl/PImpl.java |   8 +-
 .../xmlsec/encryption/impl/PRFBuilder.java         |  16 ++--
 .../opensaml/xmlsec/encryption/impl/PRFImpl.java   |   8 +-
 .../xmlsec/encryption/impl/PgenCounterBuilder.java |  16 ++--
 .../xmlsec/encryption/impl/PgenCounterImpl.java    |   8 +-
 .../xmlsec/encryption/impl/PublicBuilder.java      |  18 ++--
 .../xmlsec/encryption/impl/PublicImpl.java         |   8 +-
 .../opensaml/xmlsec/encryption/impl/QBuilder.java  |  16 ++--
 .../org/opensaml/xmlsec/encryption/impl/QImpl.java |   8 +-
 .../encryption/impl/RecipientKeyInfoBuilder.java   |  17 ++--
 .../encryption/impl/RecipientKeyInfoImpl.java      |   9 +-
 .../encryption/impl/ReferenceListBuilder.java      |  16 ++--
 .../xmlsec/encryption/impl/ReferenceListImpl.java  |  38 ++++----
 .../encryption/impl/ReferenceListUnmarshaller.java |   6 +-
 .../xmlsec/encryption/impl/ReferenceTypeImpl.java  |  44 ++++-----
 .../encryption/impl/ReferenceTypeMarshaller.java   |   7 +-
 .../encryption/impl/ReferenceTypeUnmarshaller.java |   9 +-
 .../xmlsec/encryption/impl/SaltBuilder.java        |  18 ++--
 .../opensaml/xmlsec/encryption/impl/SaltImpl.java  |   7 +-
 .../xmlsec/encryption/impl/SaltUnmarshaller.java   |   6 +-
 .../xmlsec/encryption/impl/SeedBuilder.java        |  16 ++--
 .../opensaml/xmlsec/encryption/impl/SeedImpl.java  |   8 +-
 .../xmlsec/encryption/impl/SpecifiedBuilder.java   |  19 ++--
 .../xmlsec/encryption/impl/SpecifiedImpl.java      |   8 +-
 .../xmlsec/encryption/impl/TransformsBuilder.java  |  16 ++--
 .../xmlsec/encryption/impl/TransformsImpl.java     |  33 ++++---
 .../encryption/impl/TransformsUnmarshaller.java    |   6 +-
 .../xmlsec/signature/impl/CryptoBinaryBuilder.java |  26 ++---
 .../xmlsec/signature/impl/CryptoBinaryImpl.java    |  33 ++++---
 .../signature/impl/DEREncodedKeyValueBuilder.java  |  15 ++-
 .../signature/impl/DEREncodedKeyValueImpl.java     |  13 ++-
 .../impl/DEREncodedKeyValueMarshaller.java         |   7 +-
 .../impl/DEREncodedKeyValueUnmarshaller.java       |   5 +-
 .../xmlsec/signature/impl/DSAKeyValueBuilder.java  |  16 ++--
 .../xmlsec/signature/impl/DSAKeyValueImpl.java     |  91 +++++++++---------
 .../signature/impl/DSAKeyValueUnmarshaller.java    |   6 +-
 .../xmlsec/signature/impl/DigestMethodBuilder.java |  17 ++--
 .../xmlsec/signature/impl/DigestMethodImpl.java    |  40 ++++----
 .../signature/impl/DigestMethodMarshaller.java     |   5 +-
 .../signature/impl/DigestMethodUnmarshaller.java   |   9 +-
 .../xmlsec/signature/impl/ECKeyValueBuilder.java   |  14 ++-
 .../xmlsec/signature/impl/ECKeyValueImpl.java      |  43 +++++----
 .../signature/impl/ECKeyValueMarshaller.java       |   7 +-
 .../signature/impl/ECKeyValueUnmarshaller.java     |  10 +-
 .../xmlsec/signature/impl/ECPointTypeImpl.java     |   6 +-
 .../xmlsec/signature/impl/ExponentBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/ExponentImpl.java        |   8 +-
 .../opensaml/xmlsec/signature/impl/GBuilder.java   |  16 ++--
 .../org/opensaml/xmlsec/signature/impl/GImpl.java  |   8 +-
 .../opensaml/xmlsec/signature/impl/JBuilder.java   |  16 ++--
 .../org/opensaml/xmlsec/signature/impl/JImpl.java  |   8 +-
 .../xmlsec/signature/impl/KeyInfoBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/KeyInfoImpl.java         |  69 +++++++-------
 .../xmlsec/signature/impl/KeyInfoMarshaller.java   |   7 +-
 .../signature/impl/KeyInfoReferenceBuilder.java    |  15 ++-
 .../signature/impl/KeyInfoReferenceImpl.java       |  24 +++--
 .../signature/impl/KeyInfoReferenceMarshaller.java |   7 +-
 .../impl/KeyInfoReferenceUnmarshaller.java         |   5 +-
 .../xmlsec/signature/impl/KeyInfoUnmarshaller.java |   9 +-
 .../xmlsec/signature/impl/KeyNameBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/KeyNameImpl.java         |   8 +-
 .../xmlsec/signature/impl/KeyValueBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/KeyValueImpl.java        |  51 +++++-----
 .../signature/impl/KeyValueUnmarshaller.java       |   6 +-
 .../xmlsec/signature/impl/MgmtDataBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/MgmtDataImpl.java        |   8 +-
 .../xmlsec/signature/impl/ModulusBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/ModulusImpl.java         |   8 +-
 .../xmlsec/signature/impl/NamedCurveBuilder.java   |  14 ++-
 .../xmlsec/signature/impl/NamedCurveImpl.java      |  17 +++-
 .../signature/impl/NamedCurveMarshaller.java       |   5 +-
 .../signature/impl/NamedCurveUnmarshaller.java     |   5 +-
 .../opensaml/xmlsec/signature/impl/PBuilder.java   |  16 ++--
 .../xmlsec/signature/impl/PGPDataBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/PGPDataImpl.java         |  50 +++++-----
 .../xmlsec/signature/impl/PGPDataUnmarshaller.java |   6 +-
 .../xmlsec/signature/impl/PGPKeyIDBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/PGPKeyIDImpl.java        |   8 +-
 .../xmlsec/signature/impl/PGPKeyPacketBuilder.java |  16 ++--
 .../xmlsec/signature/impl/PGPKeyPacketImpl.java    |   8 +-
 .../org/opensaml/xmlsec/signature/impl/PImpl.java  |   8 +-
 .../xmlsec/signature/impl/PgenCounterBuilder.java  |  16 ++--
 .../xmlsec/signature/impl/PgenCounterImpl.java     |   8 +-
 .../xmlsec/signature/impl/PublicKeyBuilder.java    |  17 ++--
 .../xmlsec/signature/impl/PublicKeyImpl.java       |   6 +-
 .../opensaml/xmlsec/signature/impl/QBuilder.java   |  16 ++--
 .../org/opensaml/xmlsec/signature/impl/QImpl.java  |   8 +-
 .../xmlsec/signature/impl/RSAKeyValueBuilder.java  |  16 ++--
 .../xmlsec/signature/impl/RSAKeyValueImpl.java     |  33 ++++---
 .../signature/impl/RSAKeyValueUnmarshaller.java    |   6 +-
 .../signature/impl/RetrievalMethodBuilder.java     |  17 ++--
 .../xmlsec/signature/impl/RetrievalMethodImpl.java |  57 ++++++-----
 .../signature/impl/RetrievalMethodMarshaller.java  |   5 +-
 .../impl/RetrievalMethodUnmarshaller.java          |   9 +-
 .../xmlsec/signature/impl/SPKIDataBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/SPKIDataImpl.java        |  35 ++++---
 .../signature/impl/SPKIDataUnmarshaller.java       |   6 +-
 .../xmlsec/signature/impl/SPKISexpBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/SPKISexpImpl.java        |   8 +-
 .../xmlsec/signature/impl/SeedBuilder.java         |  16 ++--
 .../opensaml/xmlsec/signature/impl/SeedImpl.java   |   8 +-
 .../xmlsec/signature/impl/SignatureBuilder.java    |  30 +++---
 .../xmlsec/signature/impl/SignatureImpl.java       |  57 ++++++-----
 .../xmlsec/signature/impl/SignatureMarshaller.java |  37 ++++---
 .../signature/impl/SignatureUnmarshaller.java      |  13 +--
 .../xmlsec/signature/impl/TransformBuilder.java    |  16 ++--
 .../xmlsec/signature/impl/TransformImpl.java       |  45 +++++----
 .../xmlsec/signature/impl/TransformMarshaller.java |   5 +-
 .../signature/impl/TransformUnmarshaller.java      |   9 +-
 .../xmlsec/signature/impl/TransformsBuilder.java   |  16 ++--
 .../xmlsec/signature/impl/TransformsImpl.java      |  32 +++----
 .../signature/impl/TransformsUnmarshaller.java     |   6 +-
 .../xmlsec/signature/impl/X509CRLBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/X509CRLImpl.java         |  32 ++++---
 .../signature/impl/X509CertificateBuilder.java     |  17 ++--
 .../xmlsec/signature/impl/X509CertificateImpl.java |  32 +++----
 .../xmlsec/signature/impl/X509DataBuilder.java     |  16 ++--
 .../xmlsec/signature/impl/X509DataImpl.java        |  46 ++++-----
 .../signature/impl/X509DataUnmarshaller.java       |   6 +-
 .../xmlsec/signature/impl/X509DigestBuilder.java   |  17 ++--
 .../xmlsec/signature/impl/X509DigestImpl.java      |  12 ++-
 .../signature/impl/X509DigestMarshaller.java       |   5 +-
 .../signature/impl/X509DigestUnmarshaller.java     |   5 +-
 .../signature/impl/X509IssuerNameBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/X509IssuerNameImpl.java  |   9 +-
 .../signature/impl/X509IssuerSerialBuilder.java    |  17 ++--
 .../signature/impl/X509IssuerSerialImpl.java       |  34 +++----
 .../impl/X509IssuerSerialUnmarshaller.java         |   6 +-
 .../xmlsec/signature/impl/X509SKIBuilder.java      |  16 ++--
 .../xmlsec/signature/impl/X509SKIImpl.java         |   8 +-
 .../signature/impl/X509SerialNumberBuilder.java    |  20 ++--
 .../signature/impl/X509SerialNumberImpl.java       |  22 +++--
 .../signature/impl/X509SerialNumberMarshaller.java |  15 ++-
 .../impl/X509SerialNumberUnmarshaller.java         |  11 ++-
 .../signature/impl/X509SubjectNameBuilder.java     |  17 ++--
 .../xmlsec/signature/impl/X509SubjectNameImpl.java |   9 +-
 .../xmlsec/signature/impl/XPathBuilder.java        |  16 ++--
 .../opensaml/xmlsec/signature/impl/XPathImpl.java  |   8 +-
 .../opensaml/xmlsec/signature/impl/YBuilder.java   |  17 ++--
 .../org/opensaml/xmlsec/signature/impl/YImpl.java  |   8 +-
 223 files changed, 2000 insertions(+), 1745 deletions(-)

diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodBuilder.java
index 0e627a7f1..ac22d32e1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodBuilder.java
@@ -17,34 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.AgreementMethod;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.AgreementMethod}.
+ * Builder of {@link AgreementMethod}.
  */
 public class AgreementMethodBuilder extends AbstractXMLObjectBuilder<AgreementMethod> implements
         XMLEncryptionBuilder<AgreementMethod> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public AgreementMethodBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public AgreementMethod buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public AgreementMethod buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new AgreementMethodImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public AgreementMethod buildObject() {
+    @Nonnull public AgreementMethod buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, AgreementMethod.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodImpl.java
index 06d65ccb6..d9c09577a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodImpl.java
@@ -18,9 +18,10 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -31,25 +32,29 @@ import org.opensaml.xmlsec.encryption.KANonce;
 import org.opensaml.xmlsec.encryption.OriginatorKeyInfo;
 import org.opensaml.xmlsec.encryption.RecipientKeyInfo;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.AgreementMethod}.
+ * Concrete implementation of {@link AgreementMethod}.
  */
 public class AgreementMethodImpl extends AbstractXMLObject implements AgreementMethod {
     
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /** KA-Nonce child element value. */
-    private KANonce kaNonce;
+    @Nullable private KANonce kaNonce;
     
     /** OriginatorKeyInfo child element value. */
-    private OriginatorKeyInfo originatorKeyInfo;
+    @Nullable private OriginatorKeyInfo originatorKeyInfo;
     
     /** RecipientKeyInfo child element value. */
-    private RecipientKeyInfo recipientKeyInfo;
+    @Nullable private RecipientKeyInfo recipientKeyInfo;
     
     /** List of wildcard <any> XMLObject children. */
-    private IndexedXMLObjectChildrenList<XMLObject> xmlChildren;
+    @Nonnull private IndexedXMLObjectChildrenList<XMLObject> xmlChildren;
 
     /**
      * Constructor.
@@ -58,63 +63,64 @@ public class AgreementMethodImpl extends AbstractXMLObject implements AgreementM
      * @param elementLocalName element local name
      * @param namespacePrefix namespace prefix
      */
-    protected AgreementMethodImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected AgreementMethodImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         xmlChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nullable public String getAlgorithm() {
         return algorithm;
     }
 
     /** {@inheritDoc} */
-    public void setAlgorithm(final String newAlgorithm) {
+    public void setAlgorithm(@Nullable final String newAlgorithm) {
         algorithm = prepareForAssignment(algorithm, newAlgorithm);
     }
 
     /** {@inheritDoc} */
-    public KANonce getKANonce() {
+    @Nullable public KANonce getKANonce() {
         return this.kaNonce;
     }
 
     /** {@inheritDoc} */
-    public void setKANonce(final KANonce newKANonce) {
+    public void setKANonce(@Nullable final KANonce newKANonce) {
         kaNonce = prepareForAssignment(kaNonce, newKANonce);
     }
 
     /** {@inheritDoc} */
-    public OriginatorKeyInfo getOriginatorKeyInfo() {
+    @Nullable public OriginatorKeyInfo getOriginatorKeyInfo() {
         return originatorKeyInfo;
     }
 
     /** {@inheritDoc} */
-    public void setOriginatorKeyInfo(final OriginatorKeyInfo newOriginatorKeyInfo) {
+    public void setOriginatorKeyInfo(@Nullable final OriginatorKeyInfo newOriginatorKeyInfo) {
         originatorKeyInfo = prepareForAssignment(originatorKeyInfo, newOriginatorKeyInfo);
     }
 
     /** {@inheritDoc} */
-    public RecipientKeyInfo getRecipientKeyInfo() {
+    @Nullable public RecipientKeyInfo getRecipientKeyInfo() {
         return recipientKeyInfo;
     }
 
     /** {@inheritDoc} */
-    public void setRecipientKeyInfo(final RecipientKeyInfo newRecipientKeyInfo) {
+    public void setRecipientKeyInfo(@Nullable final RecipientKeyInfo newRecipientKeyInfo) {
         recipientKeyInfo = prepareForAssignment(recipientKeyInfo, newRecipientKeyInfo);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull public List<XMLObject> getUnknownXMLObjects() {
         return xmlChildren;
     }
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) xmlChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (kaNonce != null) {
@@ -134,7 +140,7 @@ public class AgreementMethodImpl extends AbstractXMLObject implements AgreementM
             return null;
         }
         
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodMarshaller.java
index 3d576d0af..119175c7d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.AgreementMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class AgreementMethodMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final AgreementMethod am = (AgreementMethod) xmlObject;
 
         if (am.getAlgorithm() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodUnmarshaller.java
index 742d587c6..390ac1a5b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AgreementMethodUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.AgreementMethod;
@@ -31,7 +33,8 @@ import org.w3c.dom.Attr;
 public class AgreementMethodUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final AgreementMethod am = (AgreementMethod) xmlObject;
 
         if (attribute.getLocalName().equals(AgreementMethod.ALGORITHM_ATTRIBUTE_NAME)) {
@@ -42,8 +45,8 @@ public class AgreementMethodUnmarshaller extends AbstractXMLEncryptionUnmarshall
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final AgreementMethod am = (AgreementMethod) parentXMLObject;
 
         if (childXMLObject instanceof KANonce) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java
index 836c60422..becd74c2b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java
@@ -21,14 +21,18 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.AlgorithmIdentifierType;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
- * Abstract implementation of {@link org.opensaml.xmlsec.encryption.AlgorithmIdentifierType}.
+ * Abstract implementation of {@link AlgorithmIdentifierType}.
  */
 public abstract class AlgorithmIdentifierTypeImpl extends AbstractXMLObject implements AlgorithmIdentifierType {
     
@@ -45,8 +49,8 @@ public abstract class AlgorithmIdentifierTypeImpl extends AbstractXMLObject impl
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected AlgorithmIdentifierTypeImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected AlgorithmIdentifierTypeImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
@@ -71,7 +75,7 @@ public abstract class AlgorithmIdentifierTypeImpl extends AbstractXMLObject impl
     }
     
     /** {@inheritDoc} */
-    @Nullable public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (parameters != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeMarshaller.java
index eda76b235..e7d097c41 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.AlgorithmIdentifierType;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class AlgorithmIdentifierTypeMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final AlgorithmIdentifierType algoIdType = (AlgorithmIdentifierType) xmlObject;
 
         if (algoIdType.getAlgorithm() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeUnmarshaller.java
index 9503fbb47..6115b8847 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeUnmarshaller.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.XMLObject;
@@ -32,7 +33,8 @@ import org.w3c.dom.Attr;
 public class AlgorithmIdentifierTypeUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final AlgorithmIdentifierType algoIdType = (AlgorithmIdentifierType) xmlObject;
 
         if (attribute.getLocalName().equals(AlgorithmIdentifierType.ALGORITHM_ATTRIB_NAME)) {
@@ -43,8 +45,8 @@ public class AlgorithmIdentifierTypeUnmarshaller extends AbstractXMLEncryptionUn
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final AlgorithmIdentifierType algoIdType = (AlgorithmIdentifierType) parentXMLObject;
         
         final QName childQName = childXMLObject.getElementQName();
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameBuilder.java
index 8a4e67d69..939f8fdc7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.CarriedKeyName;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Builder of {@link CarriedKeyName}.
  */
 public class CarriedKeyNameBuilder extends AbstractXMLObjectBuilder<CarriedKeyName> implements
         XMLEncryptionBuilder<CarriedKeyName> {
 
-    /** Constructor. */
-    public CarriedKeyNameBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public CarriedKeyName buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public CarriedKeyName buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new CarriedKeyNameImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public CarriedKeyName buildObject() {
+    @Nonnull public CarriedKeyName buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, CarriedKeyName.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameImpl.java
index e6bf2ff0d..c8373ffa6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CarriedKeyNameImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.encryption.CarriedKeyName;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Concrete implementation of {@link CarriedKeyName}.
  */
 public class CarriedKeyNameImpl extends XSStringImpl implements CarriedKeyName {
 
@@ -32,8 +35,8 @@ public class CarriedKeyNameImpl extends XSStringImpl implements CarriedKeyName {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected CarriedKeyNameImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected CarriedKeyNameImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataBuilder.java
index 69c932de5..dcc830c9d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataBuilder.java
@@ -17,28 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.CipherData;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CipherData}.
+ * Builder of {@link CipherData}.
  */
 public class CipherDataBuilder extends AbstractXMLObjectBuilder<CipherData> implements 
         XMLEncryptionBuilder<CipherData> {
 
-    /** Constructor. */
-    public CipherDataBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public CipherData buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public CipherData buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new CipherDataImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public CipherData buildObject() {
+    @Nonnull public CipherData buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, CipherData.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataImpl.java
index 4d29564b0..c43c48bcd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataImpl.java
@@ -18,25 +18,31 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.CipherData;
 import org.opensaml.xmlsec.encryption.CipherReference;
 import org.opensaml.xmlsec.encryption.CipherValue;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.CipherData}.
+ * Concrete implementation of {@link CipherData}.
  */
 public class CipherDataImpl extends AbstractXMLObject implements CipherData {
     
     /** CipherValue child element. */
-    private CipherValue cipherValue;
+    @Nullable private CipherValue cipherValue;
     
     /** CipherReference child element. */
-    private CipherReference cipherReference;
+    @Nullable private CipherReference cipherReference;
 
     /**
      * Constructor.
@@ -45,32 +51,33 @@ public class CipherDataImpl extends AbstractXMLObject implements CipherData {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected  CipherDataImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected CipherDataImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public CipherValue getCipherValue() {
-        return this.cipherValue;
+    @Nullable public CipherValue getCipherValue() {
+        return cipherValue;
     }
 
     /** {@inheritDoc} */
-    public void setCipherValue(final CipherValue newCipherValue) {
-        this.cipherValue = prepareForAssignment(this.cipherValue, newCipherValue);
+    public void setCipherValue(@Nullable final CipherValue newCipherValue) {
+        cipherValue = prepareForAssignment(cipherValue, newCipherValue);
     }
 
     /** {@inheritDoc} */
-    public CipherReference getCipherReference() {
-        return this.cipherReference;
+    @Nullable public CipherReference getCipherReference() {
+        return cipherReference;
     }
 
     /** {@inheritDoc} */
-    public void setCipherReference(final CipherReference newCipherReference) {
-        this.cipherReference = prepareForAssignment(this.cipherReference, newCipherReference);
+    public void setCipherReference(@Nullable final CipherReference newCipherReference) {
+        cipherReference = prepareForAssignment(cipherReference, newCipherReference);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (cipherValue != null) {
@@ -80,11 +87,7 @@ public class CipherDataImpl extends AbstractXMLObject implements CipherData {
             children.add(cipherReference);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataUnmarshaller.java
index 8f7ff18b3..d7c42701a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherDataUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.CipherData;
@@ -29,8 +31,8 @@ import org.opensaml.xmlsec.encryption.CipherValue;
 public class CipherDataUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final CipherData cipherData = (CipherData) parentXMLObject;
 
         if (childXMLObject instanceof CipherValue) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceBuilder.java
index 955035366..464e7c2d7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.CipherReference;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CipherReference}.
+ * Builder of {@link CipherReference}.
  */
 public class CipherReferenceBuilder extends AbstractXMLObjectBuilder<CipherReference> implements
         XMLEncryptionBuilder<CipherReference> {
 
-    /** Constructor. */
-    public CipherReferenceBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public CipherReference buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public CipherReference buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new CipherReferenceImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public CipherReference buildObject() {
+    @Nonnull public CipherReference buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, CipherReference.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
-}
+
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceImpl.java
index 1dc3114da..e9666f9f4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceImpl.java
@@ -17,25 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.CipherReference;
 import org.opensaml.xmlsec.encryption.Transforms;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.CipherReference}.
+ * Concrete implementation of {@link CipherReference}.
  */
 public class CipherReferenceImpl extends AbstractXMLObject implements CipherReference {
 
     /** URI attribute value. */
-    private String uri;
+    @Nullable private String uri;
 
     /** Transforms child element value. */
-    private Transforms transforms;
+    @Nullable private Transforms transforms;
 
     /**
      * Constructor.
@@ -44,44 +49,39 @@ public class CipherReferenceImpl extends AbstractXMLObject implements CipherRefe
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected CipherReferenceImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected CipherReferenceImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getURI() {
-        return this.uri;
+    @Nullable public String getURI() {
+        return uri;
     }
 
     /** {@inheritDoc} */
-    public void setURI(final String newURI) {
-        this.uri = prepareForAssignment(this.uri, newURI);
+    public void setURI(@Nullable final String newURI) {
+        uri = prepareForAssignment(uri, newURI);
     }
 
     /** {@inheritDoc} */
-    public Transforms getTransforms() {
-        return this.transforms;
+    @Nullable public Transforms getTransforms() {
+        return transforms;
     }
 
     /** {@inheritDoc} */
-    public void setTransforms(final Transforms newTransforms) {
-        this.transforms = prepareForAssignment(this.transforms, newTransforms);
+    public void setTransforms(@Nullable final Transforms newTransforms) {
+        transforms = prepareForAssignment(transforms, newTransforms);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
 
         if (transforms != null) {
-            children.add(transforms);
+            return CollectionSupport.singletonList(transforms);
         }
-
-        if (children.size() == 0) {
-            return null;
-        }
-
-        return Collections.unmodifiableList(children);
+        
+        return null;
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceMarshaller.java
index af1695e4f..dcd15efea 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.CipherReference;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class CipherReferenceMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final CipherReference cr = (CipherReference) xmlObject;
 
         if (cr.getURI() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceUnmarshaller.java
index 531d849c6..f5d31d91d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherReferenceUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.CipherReference;
@@ -29,7 +31,8 @@ import org.w3c.dom.Attr;
 public class CipherReferenceUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final CipherReference cr = (CipherReference) xmlObject;
 
         if (attribute.getLocalName().equals(CipherReference.URI_ATTRIB_NAME)) {
@@ -40,8 +43,8 @@ public class CipherReferenceUnmarshaller extends AbstractXMLEncryptionUnmarshall
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final CipherReference cr = (CipherReference) parentXMLObject;
 
         if (childXMLObject instanceof Transforms) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueBuilder.java
index 7231c14e2..6c6b5725e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.CipherValue;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CipherValue}.
+ * Builder of {@link CipherValue}.
  */
 public class CipherValueBuilder extends AbstractXMLObjectBuilder<CipherValue> implements
         XMLEncryptionBuilder<CipherValue> {
 
-    /** Constructor. */
-    public CipherValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public CipherValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public CipherValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new CipherValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public CipherValue buildObject() {
+    @Nonnull public CipherValue buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, CipherValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueImpl.java
index 1447a70ed..bda047432 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/CipherValueImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.encryption.CipherValue;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.CipherValue}.
+ * Concrete implementation of {@link CipherValue}.
  */
 public class CipherValueImpl extends XSBase64BinaryImpl implements CipherValue {
 
@@ -32,7 +35,8 @@ public class CipherValueImpl extends XSBase64BinaryImpl implements CipherValue {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected CipherValueImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected CipherValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsBuilder.java
index 50b117d66..15d6006b4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.ConcatKDFParams;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.ConcatKDFParams}.
+ * Builder of {@link ConcatKDFParams}.
  */
 public class ConcatKDFParamsBuilder extends AbstractXMLObjectBuilder<ConcatKDFParams>
         implements XMLEncryptionBuilder<ConcatKDFParams> {
 
-    /**
-     * Constructor.
-     */
-    public ConcatKDFParamsBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public ConcatKDFParams buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public ConcatKDFParams buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ConcatKDFParamsImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public ConcatKDFParams buildObject() {
+    @Nonnull public ConcatKDFParams buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, ConcatKDFParams.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
index c86b3b765..818f8275b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.apache.commons.codec.DecoderException;
@@ -32,7 +33,7 @@ import org.opensaml.xmlsec.encryption.ConcatKDFParams;
 import org.opensaml.xmlsec.signature.DigestMethod;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.ConcatKDFParams}.
+ * Concrete implementation of {@link ConcatKDFParams}.
  */
 public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFParams {
     
@@ -61,8 +62,8 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
      * @param elementLocalName element local name
      * @param namespacePrefix namespace prefix
      */
-    protected ConcatKDFParamsImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected ConcatKDFParamsImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsMarshaller.java
index ad65fe344..1f2c84baa 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.ConcatKDFParams;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class ConcatKDFParamsMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final ConcatKDFParams params = (ConcatKDFParams) xmlObject;
 
         if (params.getAlgorithmID() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsUnmarshaller.java
index da211b896..cc1b8d3a4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.ConcatKDFParams;
@@ -29,7 +31,8 @@ import org.w3c.dom.Attr;
 public class ConcatKDFParamsUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final ConcatKDFParams params = (ConcatKDFParams) xmlObject;
 
         if (attribute.getLocalName().equals(ConcatKDFParams.ALGORITHM_ID_ATTRIBUTE_NAME)) {
@@ -48,8 +51,8 @@ public class ConcatKDFParamsUnmarshaller extends AbstractXMLEncryptionUnmarshall
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final ConcatKDFParams params = (ConcatKDFParams) parentXMLObject;
 
         if (childXMLObject instanceof DigestMethod) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueBuilder.java
index 5a6239b65..825ec632a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueBuilder.java
@@ -17,28 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.DHKeyValue;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.DHKeyValue}.
+ * Builder of {@link DHKeyValue}.
  */
 public class DHKeyValueBuilder
     extends AbstractXMLObjectBuilder<DHKeyValue> implements XMLEncryptionBuilder<DHKeyValue> {
 
-    /** Constructor. */
-    public DHKeyValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DHKeyValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public DHKeyValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DHKeyValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DHKeyValue buildObject() {
+    @Nonnull public DHKeyValue buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, DHKeyValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueImpl.java
index 97c386caf..e75b17d65 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueImpl.java
@@ -18,9 +18,11 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.DHKeyValue;
@@ -31,28 +33,32 @@ import org.opensaml.xmlsec.encryption.Public;
 import org.opensaml.xmlsec.encryption.Q;
 import org.opensaml.xmlsec.encryption.Seed;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.DHKeyValue}.
+ * Concrete implementation of {@link DHKeyValue}.
  */
 public class DHKeyValueImpl extends AbstractXMLObject implements DHKeyValue {
     
     /** P child element. */
-    private P p;
+    @Nullable private P p;
     
     /** Q child element. */
-    private Q q;
+    @Nullable private Q q;
     
     /** Generator child element. */
-    private Generator generator;
+    @Nullable private Generator generator;
     
     /** Public element. */
-    private Public publicChild;
+    @Nullable private Public publicChild;
     
     /** seed child element. */
-    private Seed seed;
+    @Nullable private Seed seed;
     
     /** pgenCounter child element. */
-    private PgenCounter pgenCounter;
+    @Nullable private PgenCounter pgenCounter;
 
     /**
      * Constructor.
@@ -61,72 +67,73 @@ public class DHKeyValueImpl extends AbstractXMLObject implements DHKeyValue {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected DHKeyValueImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected DHKeyValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public P getP() {
-        return this.p;
+    @Nullable public P getP() {
+        return p;
     }
 
     /** {@inheritDoc} */
-    public void setP(final P newP) {
-        this.p = prepareForAssignment(this.p, newP);
+    public void setP(@Nullable final P newP) {
+        p = prepareForAssignment(p, newP);
     }
 
     /** {@inheritDoc} */
-    public Q getQ() {
-        return this.q;
+    @Nullable public Q getQ() {
+        return q;
     }
 
     /** {@inheritDoc} */
-    public void setQ(final Q newQ) {
-        this.q = prepareForAssignment(this.q, newQ);
+    public void setQ(@Nullable final Q newQ) {
+        q = prepareForAssignment(q, newQ);
     }
 
     /** {@inheritDoc} */
-    public Generator getGenerator() {
-        return this.generator;
+    @Nullable public Generator getGenerator() {
+        return generator;
     }
 
     /** {@inheritDoc} */
-    public void setGenerator(final Generator newGenerator) {
-        this.generator = prepareForAssignment(this.generator, newGenerator);
+    public void setGenerator(@Nullable final Generator newGenerator) {
+        generator = prepareForAssignment(generator, newGenerator);
     }
 
     /** {@inheritDoc} */
-    public Public getPublic() {
-        return this.publicChild;
+    @Nullable public Public getPublic() {
+        return publicChild;
     }
 
     /** {@inheritDoc} */
-    public void setPublic(final Public newPublic) {
-        this.publicChild = prepareForAssignment(this.publicChild, newPublic);
+    public void setPublic(@Nullable final Public newPublic) {
+        publicChild = prepareForAssignment(publicChild, newPublic);
     }
 
     /** {@inheritDoc} */
-    public Seed getSeed() {
-        return this.seed;
+    @Nullable public Seed getSeed() {
+        return seed;
     }
 
     /** {@inheritDoc} */
-    public void setSeed(final Seed newSeed) {
-        this.seed = prepareForAssignment(this.seed, newSeed);
+    public void setSeed(@Nullable final Seed newSeed) {
+        seed = prepareForAssignment(seed, newSeed);
     }
 
     /** {@inheritDoc} */
-    public PgenCounter getPgenCounter() {
-        return this.pgenCounter;
+    @Nullable public PgenCounter getPgenCounter() {
+        return pgenCounter;
     }
 
     /** {@inheritDoc} */
-    public void setPgenCounter(final PgenCounter newPgenCounter) {
-        this.pgenCounter = prepareForAssignment(this.pgenCounter, newPgenCounter);
+    public void setPgenCounter(@Nullable final PgenCounter newPgenCounter) {
+        pgenCounter = prepareForAssignment(pgenCounter, newPgenCounter);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (p != null) {
@@ -148,11 +155,7 @@ public class DHKeyValueImpl extends AbstractXMLObject implements DHKeyValue {
             children.add(pgenCounter);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueUnmarshaller.java
index c8f8a3d88..a154a7c01 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DHKeyValueUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.DHKeyValue;
@@ -33,8 +35,8 @@ import org.opensaml.xmlsec.encryption.Seed;
 public class DHKeyValueUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final DHKeyValue keyValue = (DHKeyValue) parentXMLObject;
 
         if (childXMLObject instanceof P) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceBuilder.java
index c95b8af51..dcf1694a7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.DataReference;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.DataReference}.
+ * Builder of {@link DataReference}.
  */
 public class DataReferenceBuilder extends AbstractXMLObjectBuilder<DataReference> implements
         XMLEncryptionBuilder<DataReference> {
 
-    /** Constructor. */
-    public DataReferenceBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DataReference buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public DataReference buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DataReferenceImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DataReference buildObject() {
+    @Nonnull public DataReference buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, DataReference.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceImpl.java
index f19418954..0ec0485a4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DataReferenceImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.DataReference;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.DataReference}.
+ * Concrete implementation of {@link DataReference}.
  */
 public class DataReferenceImpl extends ReferenceTypeImpl implements DataReference {
 
@@ -31,8 +34,8 @@ public class DataReferenceImpl extends ReferenceTypeImpl implements DataReferenc
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected DataReferenceImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected DataReferenceImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyBuilder.java
index 726ee0fb0..730367825 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.DerivedKey;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Builder of {@link DerivedKey}.
  */
 public class DerivedKeyBuilder extends AbstractXMLObjectBuilder<DerivedKey> implements
         XMLEncryptionBuilder<DerivedKey> {
 
-    /** Constructor. */
-    public DerivedKeyBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DerivedKey buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public DerivedKey buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DerivedKeyImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DerivedKey buildObject() {
+    @Nonnull public DerivedKey buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, DerivedKey.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java
index b05dee27e..962ae05fc 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -32,7 +33,7 @@ import org.opensaml.xmlsec.encryption.MasterKeyName;
 import org.opensaml.xmlsec.encryption.ReferenceList;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.DerivedKey}.
+ * Concrete implementation of {@link DerivedKey}.
  */
 public class DerivedKeyImpl extends AbstractXMLObject implements DerivedKey {
     
@@ -64,8 +65,8 @@ public class DerivedKeyImpl extends AbstractXMLObject implements DerivedKey {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected DerivedKeyImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected DerivedKeyImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyMarshaller.java
index 88ae0b118..a30166837 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class DerivedKeyMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final DerivedKey dk = (DerivedKey) xmlObject;
 
         if (dk.getRecipient() != null) {
@@ -46,7 +49,7 @@ public class DerivedKeyMarshaller extends AbstractXMLEncryptionMarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, DerivedKey.ID_ATTRIBUTE_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameBuilder.java
index fec5d9e49..665a9ce6c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.CarriedKeyName;
 import org.opensaml.xmlsec.encryption.DerivedKeyName;
@@ -24,24 +27,21 @@ import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Builder of {@link DerivedKeyName}.
  */
 public class DerivedKeyNameBuilder extends AbstractXMLObjectBuilder<DerivedKeyName> implements
         XMLEncryptionBuilder<DerivedKeyName> {
 
-    /** Constructor. */
-    public DerivedKeyNameBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DerivedKeyName buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public DerivedKeyName buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DerivedKeyNameImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DerivedKeyName buildObject() {
+    @Nonnull public DerivedKeyName buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, CarriedKeyName.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameImpl.java
index bd97ab1a6..730256fd6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyNameImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.encryption.DerivedKeyName;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.DerivedKeyName}.
+ * Concrete implementation of {@link DerivedKeyName}.
  */
 public class DerivedKeyNameImpl extends XSStringImpl implements DerivedKeyName {
 
@@ -32,8 +35,8 @@ public class DerivedKeyNameImpl extends XSStringImpl implements DerivedKeyName {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected DerivedKeyNameImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected DerivedKeyNameImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyUnmarshaller.java
index 154230464..5d181621f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.DerivedKey;
@@ -32,7 +34,8 @@ import org.w3c.dom.Attr;
 public class DerivedKeyUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final DerivedKey dk = (DerivedKey) xmlObject;
 
         if (attribute.getLocalName().equals(DerivedKey.ID_ATTRIBUTE_NAME)) {
@@ -48,8 +51,8 @@ public class DerivedKeyUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final DerivedKey dk = (DerivedKey) parentXMLObject;
 
         if (childXMLObject instanceof KeyDerivationMethod) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataBuilder.java
index 8a51f3bfb..7da551bbe 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.EncryptedData}.
+ * Builder of {@link EncryptedData}.
  */
 public class EncryptedDataBuilder extends AbstractXMLObjectBuilder<EncryptedData> implements
         XMLEncryptionBuilder<EncryptedData> {
 
-    /** Constructor. */
-    public EncryptedDataBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public EncryptedData buildObject() {
+    @Nonnull public EncryptedData buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, EncryptedData.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
     /** {@inheritDoc} */
-    public EncryptedData buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public EncryptedData buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new EncryptedDataImpl(namespaceURI, localName, namespacePrefix);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataImpl.java
index b84f61e93..0b27d65f1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedDataImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.EncryptedData;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.EncryptedData}.
+ * Concrete implementation of {@link EncryptedData}.
  */
 public class EncryptedDataImpl extends EncryptedTypeImpl implements EncryptedData {
 
@@ -31,8 +34,8 @@ public class EncryptedDataImpl extends EncryptedTypeImpl implements EncryptedDat
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected EncryptedDataImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected EncryptedDataImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyBuilder.java
index cd1a3aca8..8b50d93b4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.EncryptedKey}.
+ * Builder of {@link EncryptedKey}.
  */
 public class EncryptedKeyBuilder extends AbstractXMLObjectBuilder<EncryptedKey> implements
         XMLEncryptionBuilder<EncryptedKey> {
 
-    /** Constructor. */
-    public EncryptedKeyBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public EncryptedKey buildObject() {
+    @Nonnull public EncryptedKey buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, EncryptedKey.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
     /** {@inheritDoc} */
-    public EncryptedKey buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public EncryptedKey buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new EncryptedKeyImpl(namespaceURI, localName, namespacePrefix);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyImpl.java
index 3c8fbbd71..bcd9f0eb6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyImpl.java
@@ -18,27 +18,33 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.CarriedKeyName;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.opensaml.xmlsec.encryption.ReferenceList;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.EncryptedKey}.
+ * Concrete implementation of {@link EncryptedKey}.
  */
 public class EncryptedKeyImpl extends EncryptedTypeImpl implements EncryptedKey {
     
     /** Recipient value. */
-    private String recipient;
+    @Nullable private String recipient;
     
     /** CarriedKeyName value. */
-    private CarriedKeyName carriedKeyName;
+    @Nullable private CarriedKeyName carriedKeyName;
     
     /** ReferenceList value. */
-    private ReferenceList referenceList;
+    @Nullable private ReferenceList referenceList;
 
     /**
      * Constructor.
@@ -47,42 +53,43 @@ public class EncryptedKeyImpl extends EncryptedTypeImpl implements EncryptedKey
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected EncryptedKeyImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected EncryptedKeyImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getRecipient() {
-        return this.recipient;
+    @Nullable public String getRecipient() {
+        return recipient;
     }
 
     /** {@inheritDoc} */
-    public void setRecipient(final String newRecipient) {
-        this.recipient = prepareForAssignment(this.recipient, newRecipient);
+    public void setRecipient(@Nullable final String newRecipient) {
+        recipient = prepareForAssignment(recipient, newRecipient);
     }
 
     /** {@inheritDoc} */
-    public ReferenceList getReferenceList() {
-        return this.referenceList;
+    @Nullable public ReferenceList getReferenceList() {
+        return referenceList;
     }
 
     /** {@inheritDoc} */
-    public void setReferenceList(final ReferenceList newReferenceList) {
-        this.referenceList = prepareForAssignment(this.referenceList, newReferenceList);
+    public void setReferenceList(@Nullable final ReferenceList newReferenceList) {
+        referenceList = prepareForAssignment(referenceList, newReferenceList);
     }
 
     /** {@inheritDoc} */
-    public CarriedKeyName getCarriedKeyName() {
-        return this.carriedKeyName;
+    @Nullable  public CarriedKeyName getCarriedKeyName() {
+        return carriedKeyName;
     }
 
     /** {@inheritDoc} */
-    public void setCarriedKeyName(final CarriedKeyName newCarriedKeyName) {
-        this.carriedKeyName = prepareForAssignment(this.carriedKeyName, newCarriedKeyName);
+    public void setCarriedKeyName(@Nullable final CarriedKeyName newCarriedKeyName) {
+        carriedKeyName = prepareForAssignment(carriedKeyName, newCarriedKeyName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (super.getOrderedChildren() != null) {
@@ -96,11 +103,7 @@ public class EncryptedKeyImpl extends EncryptedTypeImpl implements EncryptedKey
             children.add(carriedKeyName);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyMarshaller.java
index cb09368f8..283be338a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyMarshaller.java
@@ -17,18 +17,21 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.w3c.dom.Element;
 
 /**
- * A thread-safe Marshaller for {@link org.opensaml.xmlsec.encryption.EncryptedKey} objects.
+ * A thread-safe Marshaller for {@link EncryptedKey} objects.
  */
 public class EncryptedKeyMarshaller extends EncryptedTypeMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final EncryptedKey ek = (EncryptedKey) xmlObject;
 
         if (ek.getRecipient() != null) {
@@ -38,4 +41,4 @@ public class EncryptedKeyMarshaller extends EncryptedTypeMarshaller {
         super.marshallAttributes(xmlObject, domElement);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyUnmarshaller.java
index 58cff29f9..3ad135915 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedKeyUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.CarriedKeyName;
@@ -25,12 +27,13 @@ import org.opensaml.xmlsec.encryption.ReferenceList;
 import org.w3c.dom.Attr;
 
 /**
- * A thread-safe Unmarshaller for {@link org.opensaml.xmlsec.encryption.EncryptedKey} objects.
+ * A thread-safe Unmarshaller for {@link EncryptedKey} objects.
  */
 public class EncryptedKeyUnmarshaller extends EncryptedTypeUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final EncryptedKey ek = (EncryptedKey) xmlObject;
 
         if (attribute.getLocalName().equals(EncryptedKey.RECIPIENT_ATTRIB_NAME)) {
@@ -41,8 +44,8 @@ public class EncryptedKeyUnmarshaller extends EncryptedTypeUnmarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final EncryptedKey ek = (EncryptedKey) parentXMLObject;
 
         if (childXMLObject instanceof ReferenceList) {
@@ -54,4 +57,4 @@ public class EncryptedKeyUnmarshaller extends EncryptedTypeUnmarshaller {
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeImpl.java
index 65f06594b..4a3c16f6c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeImpl.java
@@ -18,9 +18,11 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.CipherData;
@@ -29,34 +31,38 @@ import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.EncryptionProperties;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Abstract implementation of {@link org.opensaml.xmlsec.encryption.EncryptedType}.
+ * Abstract implementation of {@link EncryptedType}.
  */
 public abstract class EncryptedTypeImpl extends AbstractXMLObject implements EncryptedType {
     
     /** id attribute value. */
-    private String id;
+    @Nullable private String id;
     
     /** Type attribute value. */
-    private String type;
+    @Nullable private String type;
     
     /** MimeType attribute value. */
-    private String mimeType;
+    @Nullable private String mimeType;
     
     /** Encoding attribute value. */
-    private String encoding;
+    @Nullable private String encoding;
     
     /** EncryptionMethod child element. */
-    private EncryptionMethod encryptionMethod;
+    @Nullable private EncryptionMethod encryptionMethod;
     
     /** EncryptionMethod child element. */
-    private KeyInfo keyInfo;
+    @Nullable private KeyInfo keyInfo;
     
     /** CipherData child element. */
-    private CipherData cipherData;
+    @Nullable private CipherData cipherData;
     
     /** EncryptionProperties child element. */
-    private EncryptionProperties encryptionProperties;
+    @Nullable private EncryptionProperties encryptionProperties;
     
     /**
      * Constructor.
@@ -65,95 +71,95 @@ public abstract class EncryptedTypeImpl extends AbstractXMLObject implements Enc
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected EncryptedTypeImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected EncryptedTypeImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
     
     /** {@inheritDoc} */
-    public String getID() {
-        return this.id;
+    @Nullable public String getID() {
+        return id;
     }
     
     /** {@inheritDoc} */
-    public void setID(final String newID) {
-        final String oldID = this.id;
-        this.id = prepareForAssignment(this.id, newID);
-        registerOwnID(oldID, this.id);
+    public void setID(@Nullable final String newID) {
+        final String oldID = id;
+        id = prepareForAssignment(id, newID);
+        registerOwnID(oldID, id);
     }
     
     /** {@inheritDoc} */
-    public String getType() {
-        return this.type;
+    @Nullable public String getType() {
+        return type;
     }
     
     /** {@inheritDoc} */
-    public void setType(final String newType) {
-        this.type = prepareForAssignment(this.type, newType);
+    public void setType(@Nullable final String newType) {
+        type = prepareForAssignment(type, newType);
     }
     
     /** {@inheritDoc} */
-    public String getMimeType() {
-        return this.mimeType;
+    @Nullable public String getMimeType() {
+        return mimeType;
     }
     
     /** {@inheritDoc} */
-    public void setMimeType(final String newMimeType) {
-        this.mimeType = prepareForAssignment(this.mimeType, newMimeType);
+    public void setMimeType(@Nullable final String newMimeType) {
+        mimeType = prepareForAssignment(mimeType, newMimeType);
     }
     
     /** {@inheritDoc} */
-    public String getEncoding() {
-        return this.encoding;
+    @Nullable public String getEncoding() {
+        return encoding;
     }
     
     /** {@inheritDoc} */
-    public void setEncoding(final String newEncoding) {
-        this.encoding = prepareForAssignment(this.encoding, newEncoding);
+    public void setEncoding(@Nullable final String newEncoding) {
+        encoding = prepareForAssignment(encoding, newEncoding);
     }
 
     /** {@inheritDoc} */
-    public EncryptionMethod getEncryptionMethod() {
-        return this.encryptionMethod;
+    @Nullable public EncryptionMethod getEncryptionMethod() {
+        return encryptionMethod;
     }
 
     /** {@inheritDoc} */
-    public void setEncryptionMethod(final EncryptionMethod newEncryptionMethod) {
-        this.encryptionMethod = prepareForAssignment(this.encryptionMethod, newEncryptionMethod);
+    public void setEncryptionMethod(@Nullable final EncryptionMethod newEncryptionMethod) {
+        encryptionMethod = prepareForAssignment(encryptionMethod, newEncryptionMethod);
     }
 
     /** {@inheritDoc} */
-    public KeyInfo getKeyInfo() {
-        return this.keyInfo;
+    @Nullable public KeyInfo getKeyInfo() {
+        return keyInfo;
     }
 
     /** {@inheritDoc} */
-    public void setKeyInfo(final KeyInfo newKeyInfo) {
-        this.keyInfo = prepareForAssignment(this.keyInfo, newKeyInfo);
+    public void setKeyInfo(@Nullable final KeyInfo newKeyInfo) {
+        keyInfo = prepareForAssignment(keyInfo, newKeyInfo);
     }
 
     /** {@inheritDoc} */
-    public CipherData getCipherData() {
-        return this.cipherData;
+    @Nullable public CipherData getCipherData() {
+        return cipherData;
     }
 
     /** {@inheritDoc} */
-    public void setCipherData(final CipherData newCipherData) {
-        this.cipherData = prepareForAssignment(this.cipherData, newCipherData);
+    public void setCipherData(@Nullable final CipherData newCipherData) {
+        cipherData = prepareForAssignment(cipherData, newCipherData);
     }
 
     /** {@inheritDoc} */
-    public EncryptionProperties getEncryptionProperties() {
-        return this.encryptionProperties;
+    @Nullable public EncryptionProperties getEncryptionProperties() {
+        return encryptionProperties;
     }
 
     /** {@inheritDoc} */
-    public void setEncryptionProperties(final EncryptionProperties newEncryptionProperties) {
-        this.encryptionProperties = prepareForAssignment(this.encryptionProperties, newEncryptionProperties);
+    public void setEncryptionProperties(@Nullable final EncryptionProperties newEncryptionProperties) {
+        encryptionProperties = prepareForAssignment(encryptionProperties, newEncryptionProperties);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (encryptionMethod != null) {
@@ -169,11 +175,7 @@ public abstract class EncryptedTypeImpl extends AbstractXMLObject implements Enc
             children.add(encryptionProperties);
         }
         
-        if (children.size() == 0) {
-           return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeMarshaller.java
index 8dc529fea..0f0fde564 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public abstract class EncryptedTypeMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final EncryptedType et = (EncryptedType) xmlObject;
 
         if (et.getID() != null) {
@@ -51,7 +54,7 @@ public abstract class EncryptedTypeMarshaller extends AbstractXMLEncryptionMarsh
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, EncryptedType.ID_ATTRIB_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeUnmarshaller.java
index 65bbe1e14..3cc973acb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptedTypeUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.CipherData;
@@ -32,8 +34,8 @@ import org.w3c.dom.Attr;
 public abstract class EncryptedTypeUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final EncryptedType et = (EncryptedType) parentXMLObject;
 
         if (childXMLObject instanceof EncryptionMethod) {
@@ -51,7 +53,8 @@ public abstract class EncryptedTypeUnmarshaller extends AbstractXMLEncryptionUnm
     }
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final EncryptedType et = (EncryptedType) xmlObject;
 
         if (attribute.getLocalName().equals(EncryptedType.ID_ATTRIB_NAME)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodBuilder.java
index 7be59f851..2247ff327 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodBuilder.java
@@ -17,32 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.EncryptionMethod}.
+ * Builder of {@link EncryptionMethod}.
  */
 public class EncryptionMethodBuilder extends AbstractXMLObjectBuilder<EncryptionMethod> implements
         XMLEncryptionBuilder<EncryptionMethod> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public EncryptionMethodBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public EncryptionMethod buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public EncryptionMethod buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new EncryptionMethodImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public EncryptionMethod buildObject() {
+    @Nonnull public EncryptionMethod buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, EncryptionMethod.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodImpl.java
index 5711d06ea..35f702ff0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodImpl.java
@@ -18,9 +18,10 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -30,22 +31,27 @@ import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.KeySize;
 import org.opensaml.xmlsec.encryption.OAEPparams;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.EncryptionMethod}.
+ * Concrete implementation of {@link EncryptionMethod}.
  */
 public class EncryptionMethodImpl extends AbstractXMLObject implements EncryptionMethod {
     
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /** KeySize child element value. */
-    private KeySize keySize;
+    @Nullable private KeySize keySize;
     
     /** OAEPparams child element value. */
-    private OAEPparams oaepParams;
+    @Nullable private OAEPparams oaepParams;
     
     /** "any" children. */
-    private final IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
     
     /**
      * Constructor.
@@ -54,54 +60,56 @@ public class EncryptionMethodImpl extends AbstractXMLObject implements Encryptio
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected EncryptionMethodImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected EncryptionMethodImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         
         unknownChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nullable public String getAlgorithm() {
         return algorithm;
     }
 
     /** {@inheritDoc} */
-    public void setAlgorithm(final String newAlgorithm) {
+    public void setAlgorithm(@Nullable final String newAlgorithm) {
         algorithm = prepareForAssignment(algorithm, newAlgorithm);
     }
 
     /** {@inheritDoc} */
-    public KeySize getKeySize() {
+    @Nullable public KeySize getKeySize() {
         return keySize;
     }
 
     /** {@inheritDoc} */
-    public void setKeySize(final KeySize newKeySize) {
+    public void setKeySize(@Nullable final KeySize newKeySize) {
         keySize = prepareForAssignment(keySize, newKeySize);
     }
 
     /** {@inheritDoc} */
-    public OAEPparams getOAEPparams() {
+    @Nullable public OAEPparams getOAEPparams() {
         return oaepParams;
     }
 
     /** {@inheritDoc} */
-    public void setOAEPparams(final OAEPparams newOAEPparams) {
+    public void setOAEPparams(@Nullable final OAEPparams newOAEPparams) {
         oaepParams = prepareForAssignment(oaepParams, newOAEPparams);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
+    
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (keySize != null) {
@@ -113,11 +121,7 @@ public class EncryptionMethodImpl extends AbstractXMLObject implements Encryptio
         
         children.addAll(unknownChildren);
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodMarshaller.java
index 7f8929654..2feb880af 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.EncryptionMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class EncryptionMethodMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final EncryptionMethod em = (EncryptionMethod) xmlObject;
 
         if (em.getAlgorithm() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodUnmarshaller.java
index 30799e687..80d51b825 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionMethodUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.EncryptionMethod;
@@ -30,7 +32,8 @@ import org.w3c.dom.Attr;
 public class EncryptionMethodUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final EncryptionMethod em = (EncryptionMethod) xmlObject;
 
         if (attribute.getLocalName().equals(EncryptionMethod.ALGORITHM_ATTRIB_NAME)) {
@@ -41,8 +44,8 @@ public class EncryptionMethodUnmarshaller extends AbstractXMLEncryptionUnmarshal
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final EncryptionMethod em = (EncryptionMethod) parentXMLObject;
         if (childXMLObject instanceof KeySize) {
             em.setKeySize((KeySize) childXMLObject);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesBuilder.java
index 6cbc0c371..5b6b5d3cd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesBuilder.java
@@ -17,34 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.EncryptionProperties;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.EncryptionProperties}.
+ * Builder of {@link EncryptionProperties}.
  */
 public class EncryptionPropertiesBuilder extends AbstractXMLObjectBuilder<EncryptionProperties> implements
         XMLEncryptionBuilder<EncryptionProperties> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public EncryptionPropertiesBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public EncryptionProperties buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public EncryptionProperties buildObject(@Nullable final String namespaceURI,
+            @Nonnull final String localName, @Nullable final String namespacePrefix) {
         return new EncryptionPropertiesImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public EncryptionProperties buildObject() {
+    @Nonnull public EncryptionProperties buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, EncryptionProperties.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesImpl.java
index 03bf55b18..74ba9969c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesImpl.java
@@ -17,26 +17,32 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
 import org.opensaml.xmlsec.encryption.EncryptionProperties;
 import org.opensaml.xmlsec.encryption.EncryptionProperty;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.EncryptionProperties}.
+ * Concrete implementation of {@link EncryptionProperties}.
  */
 public class EncryptionPropertiesImpl extends AbstractXMLObject implements EncryptionProperties {
     
     /** Id attribute value. */
-    private String id;
+    @Nullable private String id;
     
     /** EncryptionProperty child elements. */
-    private final XMLObjectChildrenList<EncryptionProperty> encryptionProperties;
+    @Nonnull private final XMLObjectChildrenList<EncryptionProperty> encryptionProperties;
 
     /**
      * Constructor.
@@ -45,40 +51,32 @@ public class EncryptionPropertiesImpl extends AbstractXMLObject implements Encry
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected EncryptionPropertiesImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected EncryptionPropertiesImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         encryptionProperties = new XMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public String getID() {
-        return this.id;
+    @Nullable public String getID() {
+        return id;
     }
 
     /** {@inheritDoc} */
-    public void setID(final String newID) {
-        final String oldID = this.id;
-        this.id = prepareForAssignment(this.id, newID);
-        registerOwnID(oldID, this.id);
+    public void setID(@Nullable final String newID) {
+        final String oldID = id;
+        id = prepareForAssignment(id, newID);
+        registerOwnID(oldID, id);
     }
 
     /** {@inheritDoc} */
-    public List<EncryptionProperty> getEncryptionProperties() {
+    @Nonnull @Live public List<EncryptionProperty> getEncryptionProperties() {
         return encryptionProperties;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(encryptionProperties);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(encryptionProperties);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesMarshaller.java
index 69668913e..a81e292a4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class EncryptionPropertiesMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final EncryptionProperties ep = (EncryptionProperties) xmlObject;
 
         if (ep.getID() != null) {
@@ -39,7 +42,7 @@ public class EncryptionPropertiesMarshaller extends AbstractXMLEncryptionMarshal
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, EncryptionProperties.ID_ATTRIB_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesUnmarshaller.java
index 4d3a3592b..41a65cf2b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertiesUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.EncryptionProperties;
@@ -29,7 +31,8 @@ import org.w3c.dom.Attr;
 public class EncryptionPropertiesUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final EncryptionProperties ep = (EncryptionProperties) xmlObject;
 
         if (attribute.getLocalName().equals(EncryptionProperties.ID_ATTRIB_NAME)) {
@@ -41,8 +44,8 @@ public class EncryptionPropertiesUnmarshaller extends AbstractXMLEncryptionUnmar
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final EncryptionProperties ep = (EncryptionProperties) parentXMLObject;
 
         if (childXMLObject instanceof EncryptionProperty) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyBuilder.java
index bc4a34237..4a70204f9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.EncryptionProperty;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.EncryptionProperty}.
+ * Builder of {@link EncryptionProperty}.
  */
 public class EncryptionPropertyBuilder extends AbstractXMLObjectBuilder<EncryptionProperty> implements
         XMLEncryptionBuilder<EncryptionProperty> {
 
-    /**
-     * Constructor.
-     */
-    public EncryptionPropertyBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public EncryptionProperty buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public EncryptionProperty buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new EncryptionPropertyImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public EncryptionProperty buildObject() {
+    @Nonnull public EncryptionProperty buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, EncryptionProperty.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyImpl.java
index 0971550c1..586f677d9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyImpl.java
@@ -17,34 +17,40 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
+import org.opensaml.xmlsec.encryption.EncryptionProperty;
+
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.EncryptionProperty}.
+ * Concrete implementation of {@link EncryptionProperty}.
  */
 public class EncryptionPropertyImpl extends AbstractXMLObject implements
-        org.opensaml.xmlsec.encryption.EncryptionProperty {
+        EncryptionProperty {
     
     /** Target attribute value. */
-    private String target;
+    @Nullable private String target;
     
     /** Id attribute value. */
-    private String id;
+    @Nullable private String id;
     
     /** Child elements from the <any> content model. */
-    private final IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
     
     /** "anyAttribute" attributes. */
-    private final AttributeMap unknownAttributes;
+    @Nonnull private final AttributeMap unknownAttributes;
 
     /**
      * Constructor.
@@ -53,60 +59,54 @@ public class EncryptionPropertyImpl extends AbstractXMLObject implements
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected EncryptionPropertyImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected EncryptionPropertyImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         unknownChildren = new IndexedXMLObjectChildrenList<>(this);
         unknownAttributes =  new AttributeMap(this);
     }
 
     /** {@inheritDoc} */
-    public String getTarget() {
-        return this.target;
+    @Nullable public String getTarget() {
+        return target;
     }
 
     /** {@inheritDoc} */
-    public void setTarget(final String newTarget) {
-        this.target = prepareForAssignment(this.target, newTarget);
+    public void setTarget(@Nullable final String newTarget) {
+        target = prepareForAssignment(target, newTarget);
     }
 
     /** {@inheritDoc} */
-    public String getID() {
-        return this.id;
+    @Nullable public String getID() {
+        return id;
     }
 
     /** {@inheritDoc} */
-    public void setID(final String newID) {
-        final String oldID = this.id;
-        this.id = prepareForAssignment(this.id, newID);
-        registerOwnID(oldID, this.id);
+    public void setID(@Nullable final String newID) {
+        final String oldID = id;
+        id = prepareForAssignment(id, newID);
+        registerOwnID(oldID, id);
     }
 
     /** {@inheritDoc} */
-    public AttributeMap getUnknownAttributes() {
+    @Nonnull public AttributeMap getUnknownAttributes() {
         return unknownAttributes;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
+    
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(unknownChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyMarshaller.java
index b15d4aa66..eaad6e106 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/EncryptionPropertyMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class EncryptionPropertyMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final EncryptionProperty ep = (EncryptionProperty) xmlObject;
 
         if (ep.getID() != null) {
@@ -43,11 +46,9 @@ public class EncryptionPropertyMarshaller extends AbstractXMLEncryptionMarshalle
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
-        final EncryptionProperty ep = (EncryptionProperty) xmlObject;
-
         XMLObjectSupport.marshallAttributeIDness(null, EncryptionProperty.ID_ATTRIB_NAME, domElement, true);
 
         super.marshallAttributeIDness(xmlObject, domElement);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorBuilder.java
index 4bc888274..5681c732d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorBuilder.java
@@ -17,32 +17,29 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Generator;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.Generator}.
+ * Builder of {@link Generator}.
  */
 public class GeneratorBuilder extends AbstractXMLObjectBuilder<Generator> implements XMLEncryptionBuilder<Generator> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public GeneratorBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Generator buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Generator buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new GeneratorImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Generator buildObject() {
+    @Nonnull public Generator buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, Generator.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorImpl.java
index 565503bd9..c76a1e9c0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/GeneratorImpl.java
@@ -17,12 +17,15 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.Generator;
 import org.opensaml.xmlsec.signature.impl.CryptoBinaryImpl;
 
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Generator}.
+ * Concrete implementation of {@link Generator}.
  */
 public class GeneratorImpl extends CryptoBinaryImpl implements Generator {
 
@@ -33,7 +36,8 @@ public class GeneratorImpl extends CryptoBinaryImpl implements Generator {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected GeneratorImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected GeneratorImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountBuilder.java
index 24eca0d09..861b4b899 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.IterationCount;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Builder of {@link IterationCount}.
  */
 public class IterationCountBuilder extends AbstractXMLObjectBuilder<IterationCount> implements
         XMLEncryptionBuilder<IterationCount> {
 
-    /** Constructor. */
-    public IterationCountBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public IterationCount buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public IterationCount buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new IterationCountImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public IterationCount buildObject() {
+    @Nonnull public IterationCount buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, IterationCount.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountImpl.java
index 64930e2f7..efdfe8f7b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/IterationCountImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSIntegerImpl;
 import org.opensaml.xmlsec.encryption.IterationCount;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.IterationCount}.
+ * Concrete implementation of {@link IterationCount}.
  */
 public class IterationCountImpl extends XSIntegerImpl implements IterationCount {
 
@@ -32,8 +35,8 @@ public class IterationCountImpl extends XSIntegerImpl implements IterationCount
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected IterationCountImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected IterationCountImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceBuilder.java
index c5f0ca27d..b29e05a89 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.KANonce;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.KANonce}.
+ * Builder of {@link KANonce}.
  */
 public class KANonceBuilder extends AbstractXMLObjectBuilder<KANonce> implements XMLEncryptionBuilder<KANonce> {
 
-    /**
-     * Constructor.
-     */
-    public KANonceBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KANonce buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KANonce buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KANonceImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KANonce buildObject() {
+    @Nonnull public KANonce buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, KANonce.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceImpl.java
index ccc9237d9..f68c29e60 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KANonceImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.encryption.KANonce;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.KANonce}.
+ * Concrete implementation of {@link KANonce}.
  */
 public class KANonceImpl extends XSBase64BinaryImpl implements KANonce {
 
@@ -32,7 +35,8 @@ public class KANonceImpl extends XSBase64BinaryImpl implements KANonce {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected KANonceImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KANonceImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodBuilder.java
index e8e4c3ae9..6df7a836e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.KeyDerivationMethod;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.KANonce}.
+ * Builder of {@link KeyDerivationMethod}.
  */
 public class KeyDerivationMethodBuilder extends AbstractXMLObjectBuilder<KeyDerivationMethod>
         implements XMLEncryptionBuilder<KeyDerivationMethod> {
 
-    /**
-     * Constructor.
-     */
-    public KeyDerivationMethodBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyDerivationMethod buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public KeyDerivationMethod buildObject(@Nullable final String namespaceURI,
+            @Nonnull final String localName, @Nullable final String namespacePrefix) {
         return new KeyDerivationMethodImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyDerivationMethod buildObject() {
+    @Nonnull public KeyDerivationMethod buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, KeyDerivationMethod.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodImpl.java
index 09f86a057..fbd12eaba 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,16 +28,21 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.xmlsec.encryption.KeyDerivationMethod;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.KeyDerivationMethod}.
+ * Concrete implementation of {@link KeyDerivationMethod}.
  */
 public class KeyDerivationMethodImpl extends AbstractXMLObject implements KeyDerivationMethod {
 
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /** Wildcard children. */
-    private IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
+    @Nonnull private IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
 
     /**
      * Constructor.
@@ -48,8 +51,8 @@ public class KeyDerivationMethodImpl extends AbstractXMLObject implements KeyDer
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected KeyDerivationMethodImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected KeyDerivationMethodImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         
         unknownChildren = new IndexedXMLObjectChildrenList<>(this);
@@ -66,26 +69,19 @@ public class KeyDerivationMethodImpl extends AbstractXMLObject implements KeyDer
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-
-        children.addAll(unknownChildren);
-
-        if (children.size() == 0) {
-            return null;
-        }
-
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodMarshaller.java
index f3cf0dfc3..764279fc8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.KeyDerivationMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class KeyDerivationMethodMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final KeyDerivationMethod kdm = (KeyDerivationMethod) xmlObject;
 
         if (kdm.getAlgorithm() != null) {
@@ -38,4 +41,4 @@ public class KeyDerivationMethodMarshaller extends AbstractXMLEncryptionMarshall
         super.marshallAttributes(xmlObject, domElement);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodUnmarshaller.java
index 44500134f..1e09d0552 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyDerivationMethodUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.KeyDerivationMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class KeyDerivationMethodUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final KeyDerivationMethod kdm = (KeyDerivationMethod) xmlObject;
 
         if (attribute.getLocalName().equals(KeyDerivationMethod.ALGORITHM_ATTRIBUTE_NAME)) {
@@ -39,8 +42,8 @@ public class KeyDerivationMethodUnmarshaller extends AbstractXMLEncryptionUnmars
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final KeyDerivationMethod kdm = (KeyDerivationMethod) parentXMLObject;
 
         kdm.getUnknownXMLObjects().add(childXMLObject);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthBuilder.java
index efca56136..fd860de7b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.KeyLength;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Builder of {@link KeyLength}.
  */
 public class KeyLengthBuilder extends AbstractXMLObjectBuilder<KeyLength> implements
         XMLEncryptionBuilder<KeyLength> {
 
-    /** Constructor. */
-    public KeyLengthBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyLength buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeyLength buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyLengthImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyLength buildObject() {
+    @Nonnull public KeyLength buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, KeyLength.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthImpl.java
index a3abc713f..68b7ff778 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyLengthImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSIntegerImpl;
 import org.opensaml.xmlsec.encryption.KeyLength;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.IterationCount}.
+ * Concrete implementation of {@link KeyLength}.
  */
 public class KeyLengthImpl extends XSIntegerImpl implements KeyLength {
 
@@ -32,8 +35,8 @@ public class KeyLengthImpl extends XSIntegerImpl implements KeyLength {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected KeyLengthImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected KeyLengthImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceBuilder.java
index 9bf9d2ae0..e5fd14c0d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.KeyReference;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.KeyReference}.
+ * Builder of {@link KeyReference}.
  */
 public class KeyReferenceBuilder extends AbstractXMLObjectBuilder<KeyReference> implements
         XMLEncryptionBuilder<KeyReference> {
 
-    /**
-     * Constructor.
-     */
-    public KeyReferenceBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyReference buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeyReference buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyReferenceImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyReference buildObject() {
+    @Nonnull public KeyReference buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, KeyReference.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceImpl.java
index 69e1e2c64..247cadbf4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeyReferenceImpl.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.KeyReference;
 
 /**
@@ -31,7 +34,8 @@ public class KeyReferenceImpl extends ReferenceTypeImpl implements KeyReference
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected KeyReferenceImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KeyReferenceImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeBuilder.java
index 88314afde..34c1bab47 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.KeySize;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.KeySize}.
+ * Builder of {@link KeySize}.
  */
 public class KeySizeBuilder extends AbstractXMLObjectBuilder<KeySize> implements XMLEncryptionBuilder<KeySize> {
 
-    /**
-     * Constructor.
-     */
-    public KeySizeBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeySize buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeySize buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeySizeImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeySize buildObject() {
+    @Nonnull public KeySize buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, KeySize.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeImpl.java
index ecdd0d02d..474b6f916 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/KeySizeImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSIntegerImpl;
 import org.opensaml.xmlsec.encryption.KeySize;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.KeySize}.
+ * Concrete implementation of {@link KeySize}.
  */
 public class KeySizeImpl extends XSIntegerImpl implements KeySize {
 
@@ -32,7 +35,8 @@ public class KeySizeImpl extends XSIntegerImpl implements KeySize {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected KeySizeImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KeySizeImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFBuilder.java
index fcb841d74..0294b0f18 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.MGF;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.MGF}.
+ * Builder of {@link MGF}.
  */
 public class MGFBuilder extends AbstractXMLObjectBuilder<MGF> implements XMLEncryptionBuilder<MGF> {
 
-    /**
-     * Constructor.
-     */
-    public MGFBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public MGF buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public MGF buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new MGFImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public MGF buildObject() {
+    @Nonnull public MGF buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, MGF.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFImpl.java
index 8af3d9fa7..1d5cf33e9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MGFImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.MGF;
 
 /**
- * Abstract implementation of {@link org.opensaml.xmlsec.encryption.MGF}.
+ * Abstract implementation of {@link MGF}.
  */
 public class MGFImpl extends AlgorithmIdentifierTypeImpl implements MGF {
 
@@ -31,7 +34,8 @@ public class MGFImpl extends AlgorithmIdentifierTypeImpl implements MGF {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected MGFImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected MGFImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameBuilder.java
index 2272eaa48..a7d8d8938 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameBuilder.java
@@ -17,30 +17,30 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.MasterKeyName;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.CarriedKeyName}.
+ * Builder of {@link MasterKeyName}.
  */
 public class MasterKeyNameBuilder extends AbstractXMLObjectBuilder<MasterKeyName> implements
         XMLEncryptionBuilder<MasterKeyName> {
 
-    /** Constructor. */
-    public MasterKeyNameBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public MasterKeyName buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public MasterKeyName buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new MasterKeyNameImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public MasterKeyName buildObject() {
+    @Nonnull public MasterKeyName buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, MasterKeyName.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameImpl.java
index 08d5df61d..9798dc68b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/MasterKeyNameImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.encryption.MasterKeyName;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.MasterKeyName}.
+ * Concrete implementation of {@link MasterKeyName}.
  */
 public class MasterKeyNameImpl extends XSStringImpl implements MasterKeyName {
 
@@ -32,8 +35,8 @@ public class MasterKeyNameImpl extends XSStringImpl implements MasterKeyName {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected MasterKeyNameImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected MasterKeyNameImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsBuilder.java
index b77b29790..435298422 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.OAEPparams;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.OAEPparams}.
+ * Builder of {@link OAEPparams}.
  */
 public class OAEPparamsBuilder
     extends AbstractXMLObjectBuilder<OAEPparams> implements XMLEncryptionBuilder<OAEPparams> {
 
-    /**
-     * Constructor.
-     */
-    public OAEPparamsBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public OAEPparams buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public OAEPparams buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new OAEPparamsImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public OAEPparams buildObject() {
+    @Nonnull public OAEPparams buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, OAEPparams.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsImpl.java
index e4e45697f..a44b8ba70 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OAEPparamsImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.encryption.OAEPparams;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.OAEPparams}.
+ * Concrete implementation of {@link OAEPparams}.
  */
 public class OAEPparamsImpl extends XSBase64BinaryImpl implements OAEPparams {
 
@@ -32,7 +35,8 @@ public class OAEPparamsImpl extends XSBase64BinaryImpl implements OAEPparams {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected OAEPparamsImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected OAEPparamsImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoBuilder.java
index a0d346976..c529bc5cf 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.OriginatorKeyInfo;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.OriginatorKeyInfo}.
+ * Builder of {@link OriginatorKeyInfo}.
  */
 public class OriginatorKeyInfoBuilder extends AbstractXMLObjectBuilder<OriginatorKeyInfo> implements
         XMLEncryptionBuilder<OriginatorKeyInfo> {
 
-    /**
-     * Constructor.
-     */
-    public OriginatorKeyInfoBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public OriginatorKeyInfo buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public OriginatorKeyInfo buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new OriginatorKeyInfoImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public OriginatorKeyInfo buildObject() {
+    @Nonnull public OriginatorKeyInfo buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, OriginatorKeyInfo.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoImpl.java
index 246068d9f..bd45972c4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OriginatorKeyInfoImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.OriginatorKeyInfo;
 import org.opensaml.xmlsec.signature.impl.KeyInfoImpl;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.OriginatorKeyInfo}.
+ * Concrete implementation of {@link OriginatorKeyInfo}.
  */
 public class OriginatorKeyInfoImpl extends KeyInfoImpl implements OriginatorKeyInfo {
 
@@ -32,8 +35,8 @@ public class OriginatorKeyInfoImpl extends KeyInfoImpl implements OriginatorKeyI
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected OriginatorKeyInfoImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected OriginatorKeyInfoImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceBuilder.java
index 3a67eee18..4d19d8c10 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceBuilder.java
@@ -17,29 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.OtherSource;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.OtherSource}.
+ * Builder of {@link OtherSource}.
  */
-public class OtherSourceBuilder extends AbstractXMLObjectBuilder<OtherSource> implements XMLEncryptionBuilder<OtherSource> {
-
-    /**
-     * Constructor.
-     */
-    public OtherSourceBuilder() {
-    }
+public class OtherSourceBuilder extends AbstractXMLObjectBuilder<OtherSource>
+        implements XMLEncryptionBuilder<OtherSource> {
 
     /** {@inheritDoc} */
-    public OtherSource buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public OtherSource buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new OtherSourceImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public OtherSource buildObject() {
+    @Nonnull public OtherSource buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, OtherSource.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceImpl.java
index cdd6b16ca..bf9cb8a90 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/OtherSourceImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.OtherSource;
 
 /**
- * Abstract implementation of {@link org.opensaml.xmlsec.encryption.OtherSource}.
+ * Abstract implementation of {@link OtherSource}.
  */
 public class OtherSourceImpl extends AlgorithmIdentifierTypeImpl implements OtherSource {
 
@@ -31,7 +34,8 @@ public class OtherSourceImpl extends AlgorithmIdentifierTypeImpl implements Othe
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected OtherSourceImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected OtherSourceImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsBuilder.java
index 0a2211147..51558d3d2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.PBKDF2Params;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.PBKDF2Params}.
+ * Builder of {@link PBKDF2Params}.
  */
 public class PBKDF2ParamsBuilder extends AbstractXMLObjectBuilder<PBKDF2Params>
         implements XMLEncryptionBuilder<PBKDF2Params> {
 
-    /**
-     * Constructor.
-     */
-    public PBKDF2ParamsBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PBKDF2Params buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PBKDF2Params buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PBKDF2ParamsImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PBKDF2Params buildObject() {
+    @Nonnull public PBKDF2Params buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, PBKDF2Params.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java
index 1277dd4c5..613e00b2c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -32,7 +33,7 @@ import org.opensaml.xmlsec.encryption.PRF;
 import org.opensaml.xmlsec.encryption.Salt;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.PBKDF2Params}.
+ * Concrete implementation of {@link PBKDF2Params}.
  */
 public class PBKDF2ParamsImpl extends AbstractXMLObject implements PBKDF2Params {
     
@@ -55,7 +56,8 @@ public class PBKDF2ParamsImpl extends AbstractXMLObject implements PBKDF2Params
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected PBKDF2ParamsImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PBKDF2ParamsImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsUnmarshaller.java
index faf3e1cb8..230a7dc6b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.IterationCount;
@@ -31,8 +33,8 @@ import org.opensaml.xmlsec.encryption.Salt;
 public class PBKDF2ParamsUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         
         final PBKDF2Params params = (PBKDF2Params) parentXMLObject;
         
@@ -49,4 +51,4 @@ public class PBKDF2ParamsUnmarshaller extends AbstractXMLEncryptionUnmarshaller
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBuilder.java
index d8ebdb431..28dd2415f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.P;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.P}.
+ * Builder of {@link P}.
  */
 public class PBuilder extends AbstractXMLObjectBuilder<P> implements XMLEncryptionBuilder<P> {
 
-    /**
-     * Constructor.
-     */
-    public PBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public P buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public P buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public P buildObject() {
+    @Nonnull public P buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, P.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PImpl.java
index a4805d26f..ce724f1ad 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PImpl.java
@@ -17,12 +17,15 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.P;
 import org.opensaml.xmlsec.signature.impl.CryptoBinaryImpl;
 
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.P}.
+ * Concrete implementation of {@link P}.
  */
 public class PImpl extends CryptoBinaryImpl implements P {
 
@@ -33,7 +36,8 @@ public class PImpl extends CryptoBinaryImpl implements P {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected PImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFBuilder.java
index b00f69243..b31260e67 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.PRF;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.PRF}.
+ * Builder of {@link PRF}.
  */
 public class PRFBuilder extends AbstractXMLObjectBuilder<PRF> implements XMLEncryptionBuilder<PRF> {
 
-    /**
-     * Constructor.
-     */
-    public PRFBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PRF buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PRF buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PRFImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PRF buildObject() {
+    @Nonnull public PRF buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, PRF.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFImpl.java
index aaaef5021..538975db0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PRFImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.PRF;
 
 /**
- * Abstract implementation of {@link org.opensaml.xmlsec.encryption.PRF}.
+ * Abstract implementation of {@link PRF}.
  */
 public class PRFImpl extends AlgorithmIdentifierTypeImpl implements PRF {
 
@@ -31,7 +34,8 @@ public class PRFImpl extends AlgorithmIdentifierTypeImpl implements PRF {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected PRFImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PRFImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterBuilder.java
index 7e4c41358..60d711a3b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.PgenCounter;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.PgenCounter}.
+ * Builder of {@link PgenCounter}.
  */
 public class PgenCounterBuilder extends AbstractXMLObjectBuilder<PgenCounter> implements
         XMLEncryptionBuilder<PgenCounter> {
 
-    /**
-     * Constructor.
-     */
-    public PgenCounterBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PgenCounter buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PgenCounter buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PgenCounterImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PgenCounter buildObject() {
+    @Nonnull public PgenCounter buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, PgenCounter.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterImpl.java
index 8c663140a..fcaaaaa6b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PgenCounterImpl.java
@@ -17,12 +17,15 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.PgenCounter;
 import org.opensaml.xmlsec.signature.impl.CryptoBinaryImpl;
 
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.PgenCounter}.
+ * Concrete implementation of {@link PgenCounter}.
  */
 public class PgenCounterImpl extends CryptoBinaryImpl implements PgenCounter {
 
@@ -33,7 +36,8 @@ public class PgenCounterImpl extends CryptoBinaryImpl implements PgenCounter {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected PgenCounterImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PgenCounterImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicBuilder.java
index db543d0f3..4374feeec 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicBuilder.java
@@ -17,31 +17,29 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Public;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.Public}.
+ * Builder of {@link Public}.
  */
 public class PublicBuilder extends AbstractXMLObjectBuilder<Public> implements XMLEncryptionBuilder<Public> {
 
-    /**
-     * Constructor.
-     */
-    public PublicBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Public buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Public buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PublicImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Public buildObject() {
+    @Nonnull public Public buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, Public.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicImpl.java
index 76074dca8..edc26f76f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PublicImpl.java
@@ -17,12 +17,15 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.Public;
 import org.opensaml.xmlsec.signature.impl.CryptoBinaryImpl;
 
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Public}.
+ * Concrete implementation of {@link Public}.
  */
 public class PublicImpl extends CryptoBinaryImpl implements Public {
 
@@ -33,7 +36,8 @@ public class PublicImpl extends CryptoBinaryImpl implements Public {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected PublicImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PublicImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QBuilder.java
index 1d877742b..0335b9f91 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Q;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.Q}.
+ * Builder of {@link Q}.
  */
 public class QBuilder extends AbstractXMLObjectBuilder<Q> implements XMLEncryptionBuilder<Q> {
 
-    /**
-     * Constructor.
-     */
-    public QBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Q buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Q buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new QImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Q buildObject() {
+    @Nonnull public Q buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, Q.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QImpl.java
index 72cc4e4b0..8ff7edc90 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/QImpl.java
@@ -17,12 +17,15 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.Q;
 import org.opensaml.xmlsec.signature.impl.CryptoBinaryImpl;
 
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Q}.
+ * Concrete implementation of {@link Q}.
  */
 public class QImpl extends CryptoBinaryImpl implements Q {
 
@@ -33,7 +36,8 @@ public class QImpl extends CryptoBinaryImpl implements Q {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected QImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected QImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoBuilder.java
index f811dd862..5a9b724ea 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.RecipientKeyInfo;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.ReferenceList}.
+ * Builder of {@link RecipientKeyInfo}.
  */
 public class RecipientKeyInfoBuilder extends AbstractXMLObjectBuilder<RecipientKeyInfo> implements
         XMLEncryptionBuilder<RecipientKeyInfo> {
 
-    /**
-     * Constructor.
-     */
-    public RecipientKeyInfoBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public RecipientKeyInfo buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public RecipientKeyInfo buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new RecipientKeyInfoImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public RecipientKeyInfo buildObject() {
+    @Nonnull public RecipientKeyInfo buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, RecipientKeyInfo.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoImpl.java
index 07afce701..9aa9c9756 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/RecipientKeyInfoImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.RecipientKeyInfo;
 import org.opensaml.xmlsec.signature.impl.KeyInfoImpl;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.RecipientKeyInfo}.
+ * Concrete implementation of {@link RecipientKeyInfo}.
  */
 public class RecipientKeyInfoImpl extends KeyInfoImpl implements RecipientKeyInfo {
 
@@ -32,8 +35,8 @@ public class RecipientKeyInfoImpl extends KeyInfoImpl implements RecipientKeyInf
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected RecipientKeyInfoImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected RecipientKeyInfoImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListBuilder.java
index 0e4f5fd1e..9d0ae2457 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.ReferenceList;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.ReferenceList}.
+ * Builder of {@link ReferenceList}.
  */
 public class ReferenceListBuilder extends AbstractXMLObjectBuilder<ReferenceList> implements
         XMLEncryptionBuilder<ReferenceList> {
 
-    /**
-     * Constructor.
-     */
-    public ReferenceListBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public ReferenceList buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public ReferenceList buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ReferenceListImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public ReferenceList buildObject() {
+    @Nonnull public ReferenceList buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, ReferenceList.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListImpl.java
index 66d00771b..a5bb09c2c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListImpl.java
@@ -17,10 +17,11 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
@@ -29,13 +30,18 @@ import org.opensaml.xmlsec.encryption.KeyReference;
 import org.opensaml.xmlsec.encryption.ReferenceList;
 import org.opensaml.xmlsec.encryption.ReferenceType;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.ReferenceList}.
+ * Concrete implementation of {@link ReferenceList}.
  */
 public class ReferenceListImpl extends AbstractXMLObject implements ReferenceList {
     
     /** ReferenceType child elements. */
-    private final IndexedXMLObjectChildrenList<ReferenceType> indexedChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<ReferenceType> indexedChildren;
     
     /**
      * Constructor.
@@ -44,38 +50,32 @@ public class ReferenceListImpl extends AbstractXMLObject implements ReferenceLis
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected ReferenceListImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected ReferenceListImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         indexedChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public List<ReferenceType> getReferences() {
+    @Nonnull @Live public List<ReferenceType> getReferences() {
         return indexedChildren;
     }
 
     /** {@inheritDoc} */
-    public List<DataReference> getDataReferences() {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<DataReference> getDataReferences() {
         return (List<DataReference>) indexedChildren.subList(DataReference.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<KeyReference> getKeyReferences() {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<KeyReference> getKeyReferences() {
         return (List<KeyReference>) indexedChildren.subList(KeyReference.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(indexedChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(indexedChildren);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListUnmarshaller.java
index 1924e779a..52afe3bd2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceListUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.DataReference;
@@ -29,8 +31,8 @@ import org.opensaml.xmlsec.encryption.ReferenceList;
 public class ReferenceListUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final ReferenceList rl = (ReferenceList) parentXMLObject;
 
         if (childXMLObject instanceof DataReference) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeImpl.java
index 3e69042e2..d6beb3716 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeImpl.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -28,16 +28,21 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.xmlsec.encryption.ReferenceType;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.ReferenceType}.
+ * Concrete implementation of {@link ReferenceType}.
  */
 public class ReferenceTypeImpl extends AbstractXMLObject implements ReferenceType {
     
     /** URI attribute value. */
-    private String uri;
+    @Nullable private String uri;
     
     /** List of <any> XML child elements. */
-    private final IndexedXMLObjectChildrenList<XMLObject> xmlChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> xmlChildren;
 
     /**
      * Constructor.
@@ -46,43 +51,36 @@ public class ReferenceTypeImpl extends AbstractXMLObject implements ReferenceTyp
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected ReferenceTypeImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected ReferenceTypeImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         xmlChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public String getURI() {
-        return this.uri;
+    @Nullable public String getURI() {
+        return uri;
     }
 
     /** {@inheritDoc} */
-    public void setURI(final String newURI) {
-        this.uri = prepareForAssignment(this.uri, newURI);
+    public void setURI(@Nullable final String newURI) {
+        uri = prepareForAssignment(uri, newURI);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return xmlChildren;
     }
     
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) xmlChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(xmlChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(xmlChildren);
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeMarshaller.java
index fb8883f46..a5618ba75 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeMarshaller.java
@@ -17,18 +17,21 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.encryption.ReferenceType;
 import org.w3c.dom.Element;
 
 /**
- * A thread-safe Marshaller for {@link org.opensaml.xmlsec.encryption.ReferenceType} objects.
+ * A thread-safe Marshaller for {@link ReferenceType} objects.
  */
 public class ReferenceTypeMarshaller extends AbstractXMLEncryptionMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final ReferenceType rt = (ReferenceType) xmlObject;
 
         if (rt.getURI() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeUnmarshaller.java
index 188df1463..10619ea52 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ReferenceTypeUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.ReferenceType;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class ReferenceTypeUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final ReferenceType rt = (ReferenceType) xmlObject;
 
         if (attribute.getLocalName().equals(ReferenceType.URI_ATTRIB_NAME)) {
@@ -39,8 +42,8 @@ public class ReferenceTypeUnmarshaller extends AbstractXMLEncryptionUnmarshaller
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final ReferenceType rt = (ReferenceType) parentXMLObject;
 
         rt.getUnknownXMLObjects().add(childXMLObject);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltBuilder.java
index fc21c689a..94692d63d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltBuilder.java
@@ -17,32 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Salt;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.EncryptionMethod}.
+ * Builder of {@link Salt}.
  */
 public class SaltBuilder extends AbstractXMLObjectBuilder<Salt> implements
         XMLEncryptionBuilder<Salt> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public SaltBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Salt buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public Salt buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SaltImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Salt buildObject() {
+    @Nonnull public Salt buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, Salt.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java
index bfdc7b90d..bbf8063eb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -30,7 +31,7 @@ import org.opensaml.xmlsec.encryption.Salt;
 import org.opensaml.xmlsec.encryption.Specified;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Salt}.
+ * Concrete implementation of {@link Salt}.
  */
 public class SaltImpl extends AbstractXMLObject implements Salt {
     
@@ -47,8 +48,8 @@ public class SaltImpl extends AbstractXMLObject implements Salt {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected SaltImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected SaltImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltUnmarshaller.java
index 7dcddb606..bbff4efb3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.OtherSource;
@@ -29,8 +31,8 @@ import org.opensaml.xmlsec.encryption.Specified;
 public class SaltUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         
         final Salt salt = (Salt) parentXMLObject;
         
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedBuilder.java
index a36352262..a5e3b2b02 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Seed;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.Seed}.
+ * Builder of {@link Seed}.
  */
 public class SeedBuilder extends AbstractXMLObjectBuilder<Seed> implements XMLEncryptionBuilder<Seed> {
 
-    /**
-     * Constructor.
-     */
-    public SeedBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Seed buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Seed buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SeedImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Seed buildObject() {
+    @Nonnull public Seed buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, Seed.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedImpl.java
index 70d1dcf73..1af2f37f0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SeedImpl.java
@@ -17,12 +17,15 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.encryption.Seed;
 import org.opensaml.xmlsec.signature.impl.CryptoBinaryImpl;
 
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Seed}.
+ * Concrete implementation of {@link Seed}.
  */
 public class SeedImpl extends CryptoBinaryImpl implements Seed {
 
@@ -33,7 +36,8 @@ public class SeedImpl extends CryptoBinaryImpl implements Seed {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected SeedImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected SeedImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedBuilder.java
index 6ee4d86b9..d24e33889 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedBuilder.java
@@ -17,30 +17,27 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Specified;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.Specified}.
+ * Builder of {@link Specified}.
  */
-public class SpecifiedBuilder
-    extends AbstractXMLObjectBuilder<Specified> implements XMLEncryptionBuilder<Specified> {
-
-    /**
-     * Constructor.
-     */
-    public SpecifiedBuilder() {
-    }
+public class SpecifiedBuilder extends AbstractXMLObjectBuilder<Specified> implements XMLEncryptionBuilder<Specified> {
 
     /** {@inheritDoc} */
-    public Specified buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Specified buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SpecifiedImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Specified buildObject() {
+    @Nonnull public Specified buildObject() {
         return buildObject(EncryptionConstants.XMLENC11_NS, Specified.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedImpl.java
index 7ec18053c..9b6d51975 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SpecifiedImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.encryption.Specified;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Specified}.
+ * Concrete implementation of {@link Specified}.
  */
 public class SpecifiedImpl extends XSBase64BinaryImpl implements Specified {
 
@@ -32,7 +35,8 @@ public class SpecifiedImpl extends XSBase64BinaryImpl implements Specified {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected SpecifiedImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected SpecifiedImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsBuilder.java
index 7d0730e9f..f2a9dd708 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.encryption.Transforms;
 import org.opensaml.xmlsec.encryption.XMLEncryptionBuilder;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.encryption.Transforms}.
+ * Builder of {@link Transforms}.
  */
 public class TransformsBuilder
     extends AbstractXMLObjectBuilder<Transforms> implements XMLEncryptionBuilder<Transforms> {
 
-    /**
-     * Constructor.
-     */
-    public TransformsBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Transforms buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Transforms buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new TransformsImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Transforms buildObject() {
+    @Nonnull public Transforms buildObject() {
         return buildObject(EncryptionConstants.XMLENC_NS, Transforms.DEFAULT_ELEMENT_LOCAL_NAME,
                 EncryptionConstants.XMLENC_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsImpl.java
index d4051d9c7..198da4209 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsImpl.java
@@ -17,23 +17,29 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
 import org.opensaml.xmlsec.encryption.Transforms;
 import org.opensaml.xmlsec.signature.Transform;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.encryption.Transforms}.
+ * Concrete implementation of {@link Transforms}.
  */
 public class TransformsImpl extends AbstractXMLObject implements Transforms {
     
     /** Transform child elements. */
-    private final XMLObjectChildrenList<Transform> transforms;
+    @Nonnull private final XMLObjectChildrenList<Transform> transforms;
 
     /**
      * Constructor.
@@ -42,27 +48,20 @@ public class TransformsImpl extends AbstractXMLObject implements Transforms {
      * @param elementLocalName local name
      * @param namespacePrefix namespace prefix
      */
-    protected TransformsImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected TransformsImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         transforms = new XMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public List<Transform> getTransforms() {
-        return this.transforms;
+    @Nonnull @Live public List<Transform> getTransforms() {
+        return transforms;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(transforms);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(transforms);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsUnmarshaller.java
index 7160106e9..0b88942e2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/TransformsUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.encryption.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.Transforms;
@@ -28,8 +30,8 @@ import org.opensaml.xmlsec.signature.Transform;
 public class TransformsUnmarshaller extends AbstractXMLEncryptionUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final Transforms transforms = (Transforms) parentXMLObject;
 
         if (childXMLObject instanceof Transform) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryBuilder.java
index da48c18bf..845063313 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryBuilder.java
@@ -17,26 +17,30 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
-import org.opensaml.core.xml.XMLObjectBuilder;
 import org.opensaml.xmlsec.signature.CryptoBinary;
+import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
  * Builder of {@link org.opensaml.xmlsec.signature.CryptoBinary}.
  */
 public class CryptoBinaryBuilder extends AbstractXMLObjectBuilder<CryptoBinary> 
-    implements XMLObjectBuilder<CryptoBinary>{
+    implements XMLSignatureBuilder<CryptoBinary>{
 
-    /**
-     * Constructor.
-     *
-     */
-    public CryptoBinaryBuilder() {
+    /** {@inheritDoc} */
+    @Nonnull public CryptoBinary buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
+        return new CryptoBinaryImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public CryptoBinary buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
-        return new CryptoBinaryImpl(namespaceURI, localName, namespacePrefix);
+    @Nonnull public CryptoBinary buildObject() {
+        return buildObject(SignatureConstants.XMLSIG_NS, CryptoBinary.TYPE_LOCAL_NAME,
+                SignatureConstants.XMLSIG_PREFIX);
     }
-    
-}
+
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryImpl.java
index 14e10fdcd..a17b1ac82 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/CryptoBinaryImpl.java
@@ -20,27 +20,30 @@ package org.opensaml.xmlsec.signature.impl;
 import java.math.BigInteger;
 import java.util.Objects;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.signature.CryptoBinary;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.codec.EncodingException;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.CryptoBinary}.
+ * Concrete implementation of {@link CryptoBinary}.
  */
 public class CryptoBinaryImpl extends XSBase64BinaryImpl implements CryptoBinary {
     
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(CryptoBinaryImpl.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(CryptoBinaryImpl.class);
     
     /** The cached BigInteger representation of the element's base64-encoded value. */
-    private BigInteger bigIntValue;
+    @Nullable private BigInteger bigIntValue;
 
     /**
      * Constructor.
@@ -49,27 +52,30 @@ public class CryptoBinaryImpl extends XSBase64BinaryImpl implements CryptoBinary
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected CryptoBinaryImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected CryptoBinaryImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    @Override
-    public BigInteger getValueBigInt() {
-        if (bigIntValue == null && !Strings.isNullOrEmpty(getValue())) {
+    @Nullable public BigInteger getValueBigInt() {
+        if (bigIntValue == null) {
             try {
-                bigIntValue = KeyInfoSupport.decodeBigIntegerFromCryptoBinary(getValue());
+                final String value = getValue();
+                if (!Strings.isNullOrEmpty(getValue())) {
+                    assert value != null;
+                    bigIntValue = KeyInfoSupport.decodeBigIntegerFromCryptoBinary(value);
+                }
             } catch (final DecodingException e) {
                 //can not decode big integer from invalid value, return original even if null.    
-                log.warn("Could not decode big integer value, returning cached value",e);
+                log.warn("Could not decode big integer value, returning cached value", e);
             }
         }
         return bigIntValue;
     }
 
     /** {@inheritDoc} */
-    @Override
-    public void setValueBigInt(final BigInteger bigInt) throws EncodingException{
+    public void setValueBigInt(@Nullable final BigInteger bigInt) throws EncodingException{
         if (bigInt == null) {
             setValue(null);
         } else {
@@ -79,8 +85,7 @@ public class CryptoBinaryImpl extends XSBase64BinaryImpl implements CryptoBinary
     }
     
     /** {@inheritDoc} */
-    @Override
-    public void setValue(final String newValue) {
+    public void setValue(@Nullable final String newValue) {
         if (bigIntValue != null 
                 && (!Objects.equals(getValue(), newValue) || newValue == null)) {
             // Just clear the cached value, my not be needed in big int form again,
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueBuilder.java
index fe4b505f2..2045c1e7c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.DEREncodedKeyValue;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
@@ -28,20 +31,14 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 public class DEREncodedKeyValueBuilder extends AbstractXMLObjectBuilder<DEREncodedKeyValue>
     implements XMLSignatureBuilder<DEREncodedKeyValue> {
 
-    /**
-     * Constructor.
-     */
-    public DEREncodedKeyValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DEREncodedKeyValue buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public DEREncodedKeyValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DEREncodedKeyValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DEREncodedKeyValue buildObject() {
+    @Nonnull public DEREncodedKeyValue buildObject() {
         return buildObject(SignatureConstants.XMLSIG11_NS, DEREncodedKeyValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueImpl.java
index 55598d57f..7734c9cfc 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueImpl.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.signature.DEREncodedKeyValue;
 
@@ -26,7 +29,7 @@ import org.opensaml.xmlsec.signature.DEREncodedKeyValue;
 public class DEREncodedKeyValueImpl extends XSBase64BinaryImpl implements DEREncodedKeyValue {
 
     /** Algorithm attribute value. */
-    private String id;
+    @Nullable private String id;
     
     /**
      * Constructor.
@@ -35,18 +38,18 @@ public class DEREncodedKeyValueImpl extends XSBase64BinaryImpl implements DEREnc
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected DEREncodedKeyValueImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected DEREncodedKeyValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getID() {
+    @Nullable public String getID() {
         return id;
     }
 
     /** {@inheritDoc} */
-    public void setID(final String newID) {
+    public void setID(@Nullable final String newID) {
         final String oldID = id;
         id = prepareForAssignment(id, newID);
         registerOwnID(oldID, id);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueMarshaller.java
index 5436254bb..5bbfbe41b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryMarshaller;
@@ -30,7 +32,8 @@ import org.w3c.dom.Element;
 public class DEREncodedKeyValueMarshaller extends XSBase64BinaryMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final DEREncodedKeyValue der = (DEREncodedKeyValue) xmlObject;
 
         if (der.getID() != null) {
@@ -39,7 +42,7 @@ public class DEREncodedKeyValueMarshaller extends XSBase64BinaryMarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, DEREncodedKeyValue.ID_ATTRIB_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueUnmarshaller.java
index 83a787a59..b8ada2289 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DEREncodedKeyValueUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryUnmarshaller;
@@ -29,7 +31,8 @@ import org.w3c.dom.Attr;
 public class DEREncodedKeyValueUnmarshaller extends XSBase64BinaryUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final DEREncodedKeyValue der = (DEREncodedKeyValue) xmlObject;
 
         if (attribute.getLocalName().equals(DEREncodedKeyValue.ID_ATTRIB_NAME)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueBuilder.java
index 7a56569d4..4431890d9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.DSAKeyValue;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.DSAKeyValue}.
+ * Builder of {@link DSAKeyValue}.
  */
 public class DSAKeyValueBuilder extends AbstractXMLObjectBuilder<DSAKeyValue> implements
         XMLSignatureBuilder<DSAKeyValue> {
 
-    /**
-     * Constructor.
-     */
-    public DSAKeyValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DSAKeyValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public DSAKeyValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DSAKeyValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DSAKeyValue buildObject() {
+    @Nonnull public DSAKeyValue buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, DSAKeyValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueImpl.java
index b4d92dd09..d9fdfdf85 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueImpl.java
@@ -18,9 +18,11 @@
 package org.opensaml.xmlsec.signature.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.DSAKeyValue;
@@ -32,31 +34,35 @@ import org.opensaml.xmlsec.signature.Q;
 import org.opensaml.xmlsec.signature.Seed;
 import org.opensaml.xmlsec.signature.Y;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.DSAKeyValue}.
+ * Concrete implementation of {@link DSAKeyValue}.
  */
 public class DSAKeyValueImpl extends AbstractXMLObject implements DSAKeyValue {
     
     /** P child element. */
-    private P p;
+    @Nullable private P p;
     
     /** Q child element. */
-    private Q q;
+    @Nullable private Q q;
     
     /** G child element. */
-    private G g;
+    @Nullable private G g;
     
     /** Y child element. */
-    private Y y;
+    @Nullable private Y y;
     
     /** J child element. */
-    private J j;
+    @Nullable private J j;
     
     /** Seed child element. */
-    private Seed seed;
+    @Nullable private Seed seed;
     
     /** PgenCounter child element. */
-    private PgenCounter pgenCounter;
+    @Nullable private PgenCounter pgenCounter;
 
     /**
      * Constructor.
@@ -65,82 +71,83 @@ public class DSAKeyValueImpl extends AbstractXMLObject implements DSAKeyValue {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected DSAKeyValueImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected DSAKeyValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public P getP() {
-        return this.p;
+    @Nullable public P getP() {
+        return p;
     }
 
     /** {@inheritDoc} */
-    public void setP(final P newP) {
-        this.p = prepareForAssignment(this.p, newP);
+    public void setP(@Nullable final P newP) {
+        p = prepareForAssignment(p, newP);
     }
 
     /** {@inheritDoc} */
-    public Q getQ() {
-        return this.q;
+    @Nullable public Q getQ() {
+        return q;
     }
 
     /** {@inheritDoc} */
-    public void setQ(final Q newQ) {
-        this.q = prepareForAssignment(this.q, newQ);
+    public void setQ(@Nullable final Q newQ) {
+        q = prepareForAssignment(q, newQ);
     }
 
     /** {@inheritDoc} */
-    public G getG() {
-        return this.g;
+    @Nullable public G getG() {
+        return g;
     }
 
     /** {@inheritDoc} */
-    public void setG(final G newG) {
-        this.g = prepareForAssignment(this.g, newG);
+    public void setG(@Nullable final G newG) {
+        g = prepareForAssignment(g, newG);
     }
 
     /** {@inheritDoc} */
-    public Y getY() {
-        return this.y;
+    @Nullable public Y getY() {
+        return y;
     }
 
     /** {@inheritDoc} */
-    public void setY(final Y newY) {
-        this.y = prepareForAssignment(this.y, newY);
+    public void setY(@Nullable final Y newY) {
+        y = prepareForAssignment(y, newY);
     }
 
     /** {@inheritDoc} */
-    public J getJ() {
-        return this.j;
+    @Nullable public J getJ() {
+        return j;
     }
 
     /** {@inheritDoc} */
-    public void setJ(final J newJ) {
-        this.j = prepareForAssignment(this.j, newJ);
+    public void setJ(@Nullable final J newJ) {
+        j = prepareForAssignment(j, newJ);
     }
 
     /** {@inheritDoc} */
-    public Seed getSeed() {
-        return this.seed;
+    @Nullable public Seed getSeed() {
+        return seed;
     }
 
     /** {@inheritDoc} */
-    public void setSeed(final Seed newSeed) {
-        this.seed = prepareForAssignment(this.seed, newSeed);
+    public void setSeed(@Nullable final Seed newSeed) {
+        seed = prepareForAssignment(seed, newSeed);
     }
 
     /** {@inheritDoc} */
-    public PgenCounter getPgenCounter() {
-        return this.pgenCounter;
+    @Nullable public PgenCounter getPgenCounter() {
+        return pgenCounter;
     }
 
     /** {@inheritDoc} */
-    public void setPgenCounter(final PgenCounter newPgenCounter) {
-        this.pgenCounter = prepareForAssignment(this.pgenCounter, newPgenCounter);
+    public void setPgenCounter(@Nullable final PgenCounter newPgenCounter) {
+        pgenCounter = prepareForAssignment(pgenCounter, newPgenCounter);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (p != null) {
@@ -165,11 +172,7 @@ public class DSAKeyValueImpl extends AbstractXMLObject implements DSAKeyValue {
             children.add(pgenCounter);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueUnmarshaller.java
index 22f12f01e..b23a797f3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DSAKeyValueUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.DSAKeyValue;
@@ -34,8 +36,8 @@ import org.opensaml.xmlsec.signature.Y;
 public class DSAKeyValueUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final DSAKeyValue keyValue = (DSAKeyValue) parentXMLObject;
 
         if (childXMLObject instanceof P) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodBuilder.java
index 322a0b655..5544cfa6c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.DigestMethod;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.DigestMethod}.
+ * Builder of {@link DigestMethod}.
  */
 public class DigestMethodBuilder extends AbstractXMLObjectBuilder<DigestMethod> implements
         XMLSignatureBuilder<DigestMethod> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public DigestMethodBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public DigestMethod buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public DigestMethod buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new DigestMethodImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DigestMethod buildObject() {
+    @Nonnull public DigestMethod buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, DigestMethod.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodImpl.java
index 88aed22e4..cc99250cd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodImpl.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -28,16 +28,21 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.xmlsec.signature.DigestMethod;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.DigestMethod}.
+ * Concrete implementation of {@link DigestMethod}.
  */
 public class DigestMethodImpl extends AbstractXMLObject implements DigestMethod {
     
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /** "any" children. */
-    private final IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> unknownChildren;
     
     /**
      * Constructor.
@@ -46,42 +51,37 @@ public class DigestMethodImpl extends AbstractXMLObject implements DigestMethod
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected DigestMethodImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected DigestMethodImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         
         unknownChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nullable public String getAlgorithm() {
         return this.algorithm;
     }
 
     /** {@inheritDoc} */
-    public void setAlgorithm(final String newAlgorithm) {
+    public void setAlgorithm(@Nullable final String newAlgorithm) {
         this.algorithm = prepareForAssignment(this.algorithm, newAlgorithm);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live  public List<XMLObject> getUnknownXMLObjects() {
         return this.unknownChildren;
     }
+    
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(unknownChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodMarshaller.java
index 40b323638..3e48605b6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.signature.DigestMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class DigestMethodMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final DigestMethod dm = (DigestMethod) xmlObject;
 
         if (dm.getAlgorithm() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodUnmarshaller.java
index 9e337b5e8..fa49cc147 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/DigestMethodUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.DigestMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class DigestMethodUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final DigestMethod dm = (DigestMethod) xmlObject;
 
         if (attribute.getLocalName().equals(DigestMethod.ALGORITHM_ATTRIB_NAME)) {
@@ -39,8 +42,8 @@ public class DigestMethodUnmarshaller extends AbstractXMLSignatureUnmarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final DigestMethod dm = (DigestMethod) parentXMLObject;
         dm.getUnknownXMLObjects().add(childXMLObject);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueBuilder.java
index c70b876d8..9b3dffe88 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.ECKeyValue;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
@@ -28,19 +31,14 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 public class ECKeyValueBuilder extends AbstractXMLObjectBuilder<ECKeyValue>
     implements XMLSignatureBuilder<ECKeyValue> {
 
-    /**
-     * Constructor.
-     */
-    public ECKeyValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public ECKeyValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public ECKeyValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ECKeyValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public ECKeyValue buildObject() {
+    @Nonnull public ECKeyValue buildObject() {
         return buildObject(SignatureConstants.XMLSIG11_NS, ECKeyValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueImpl.java
index 2c9f17a01..ea3e566bd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueImpl.java
@@ -18,31 +18,37 @@
 package org.opensaml.xmlsec.signature.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.ECKeyValue;
 import org.opensaml.xmlsec.signature.NamedCurve;
 import org.opensaml.xmlsec.signature.PublicKey;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Concrete implementation of {@link ECKeyValue}.
  */
 public class ECKeyValueImpl extends AbstractXMLObject implements ECKeyValue {
     
     /** Id attribute value. */
-    private String id;
+    @Nullable private String id;
     
     /** ECParameters child element value. */
-    private XMLObject ecParams;
+    @Nullable private XMLObject ecParams;
     
     /** NamedCurve child element value. */
-    private NamedCurve namedCurve;
+    @Nullable private NamedCurve namedCurve;
 
     /** PublicKey child element value. */
-    private PublicKey publicKey;
+    @Nullable private PublicKey publicKey;
 
     /**
      * Constructor.
@@ -51,54 +57,55 @@ public class ECKeyValueImpl extends AbstractXMLObject implements ECKeyValue {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected ECKeyValueImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected ECKeyValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getID() {
+    @Nullable public String getID() {
         return id;
     }
 
     /** {@inheritDoc} */
-    public void setID(final String newID) {
+    public void setID(@Nullable final String newID) {
         final String oldID = id;
         id = prepareForAssignment(id, newID);
         registerOwnID(oldID, id);
     }
     
     /** {@inheritDoc} */
-    public XMLObject getECParameters() {
+    @Nullable public XMLObject getECParameters() {
         return ecParams;
     }
 
     /** {@inheritDoc} */
-    public void setECParameters(final XMLObject newParams) {
+    public void setECParameters(@Nullable final XMLObject newParams) {
         ecParams = prepareForAssignment(ecParams, newParams);
     }
     
     /** {@inheritDoc} */
-    public NamedCurve getNamedCurve() {
+    @Nullable public NamedCurve getNamedCurve() {
         return namedCurve;
     }
 
     /** {@inheritDoc} */
-    public void setNamedCurve(final NamedCurve newCurve) {
+    public void setNamedCurve(@Nullable final NamedCurve newCurve) {
         namedCurve = prepareForAssignment(namedCurve, newCurve);
     }
 
     /** {@inheritDoc} */
-    public PublicKey getPublicKey() {
+    @Nullable public PublicKey getPublicKey() {
         return publicKey;
     }
 
     /** {@inheritDoc} */
-    public void setPublicKey(final PublicKey newKey) {
+    public void setPublicKey(@Nullable final PublicKey newKey) {
         publicKey = prepareForAssignment(publicKey, newKey);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (ecParams != null) {
@@ -111,11 +118,7 @@ public class ECKeyValueImpl extends AbstractXMLObject implements ECKeyValue {
             children.add(publicKey);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueMarshaller.java
index 1313732b6..fb0fde6b2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class ECKeyValueMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final ECKeyValue ec = (ECKeyValue) xmlObject;
 
         if (ec.getID() != null) {
@@ -38,7 +41,7 @@ public class ECKeyValueMarshaller extends AbstractXMLSignatureMarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, ECKeyValue.ID_ATTRIB_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueUnmarshaller.java
index 330d4058e..cd64f60e3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECKeyValueUnmarshaller.java
@@ -35,10 +35,12 @@ import org.w3c.dom.Attr;
 public class ECKeyValueUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** ECParameters element name. */
-    @Nonnull public static final QName ECPARAMETERS_ELEMENT_NAME = new QName(SignatureConstants.XMLSIG11_NS, "ECParameters");
+    @Nonnull public static final QName ECPARAMETERS_ELEMENT_NAME =
+            new QName(SignatureConstants.XMLSIG11_NS, "ECParameters");
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final ECKeyValue ec = (ECKeyValue) xmlObject;
 
         if (attribute.getLocalName().equals(ECKeyValue.ID_ATTRIB_NAME)) {
@@ -50,8 +52,8 @@ public class ECKeyValueUnmarshaller extends AbstractXMLSignatureUnmarshaller {
     }
     
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final ECKeyValue keyValue = (ECKeyValue) parentXMLObject;
 
         if (childXMLObject instanceof NamedCurve) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECPointTypeImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECPointTypeImpl.java
index 30ec56924..e05b1e8ce 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECPointTypeImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ECPointTypeImpl.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.ECPointType;
 
 /**
@@ -31,7 +34,8 @@ public class ECPointTypeImpl extends CryptoBinaryImpl implements ECPointType {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected ECPointTypeImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected ECPointTypeImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentBuilder.java
index 0ecc0a590..3ab5d5bec 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.Exponent;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Exponent}.
+ * Builder of {@link Exponent}.
  */
 public class ExponentBuilder extends AbstractXMLObjectBuilder<Exponent> implements XMLSignatureBuilder<Exponent> {
 
-    /**
-     * Constructor.
-     */
-    public ExponentBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Exponent buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Exponent buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ExponentImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Exponent buildObject() {
+    @Nonnull public Exponent buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Exponent.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentImpl.java
index bf4e03b8b..aa575b379 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ExponentImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.Exponent;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Exponent}.
+ * Concrete implementation of {@link Exponent}.
  */
 public class ExponentImpl extends CryptoBinaryImpl implements Exponent {
 
@@ -31,7 +34,8 @@ public class ExponentImpl extends CryptoBinaryImpl implements Exponent {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected ExponentImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected ExponentImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GBuilder.java
index 71f40414b..410127600 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.G;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.G}.
+ * Builder of {@link G}.
  */
 public class GBuilder extends AbstractXMLObjectBuilder<G> implements XMLSignatureBuilder<G> {
 
-    /**
-     * Constructor.
-     */
-    public GBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public G buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public G buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new GImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public G buildObject() {
+    @Nonnull public G buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, G.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GImpl.java
index c90bb2315..53c2220f8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/GImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.G;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.G}.
+ * Concrete implementation of {@link G}.
  */
 public class GImpl extends CryptoBinaryImpl implements G {
 
@@ -31,7 +34,8 @@ public class GImpl extends CryptoBinaryImpl implements G {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected GImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected GImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JBuilder.java
index 148edb821..c8f6d6f70 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.J;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.J}.
+ * Builder of {@link J}.
  */
 public class JBuilder extends AbstractXMLObjectBuilder<J> implements XMLSignatureBuilder<J> {
 
-    /**
-     * Constructor.
-     */
-    public JBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public J buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public J buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new JImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public J buildObject() {
+    @Nonnull public J buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, J.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JImpl.java
index 72f179461..b90d26711 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/JImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.J;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.J}.
+ * Concrete implementation of {@link J}.
  */
 public class JImpl extends CryptoBinaryImpl implements J {
 
@@ -31,7 +34,8 @@ public class JImpl extends CryptoBinaryImpl implements J {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected JImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected JImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoBuilder.java
index a5fbf0f3f..aec7c1de9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.KeyInfo}.
+ * Builder of {@link KeyInfo}.
  */
 public class KeyInfoBuilder extends AbstractXMLObjectBuilder<KeyInfo> implements XMLSignatureBuilder<KeyInfo> {
 
-    /**
-     * Constructor.
-     */
-    public KeyInfoBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyInfo buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeyInfo buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyInfoImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyInfo buildObject() {
+    @Nonnull public KeyInfo buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, KeyInfo.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoImpl.java
index d6f837c87..d331bd195 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoImpl.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -39,16 +39,22 @@ import org.opensaml.xmlsec.signature.RetrievalMethod;
 import org.opensaml.xmlsec.signature.SPKIData;
 import org.opensaml.xmlsec.signature.X509Data;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.KeyInfo}.
+ * Concrete implementation of {@link KeyInfo}.
  */
+ at SuppressWarnings("unchecked")
 public class KeyInfoImpl extends AbstractXMLObject implements KeyInfo {
     
     /** The list of XMLObject child elements. */
-    private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
     
     /** The Id attribute value. */
-    private String id;
+    @Nullable private String id;
 
     /**
      * Constructor.
@@ -57,99 +63,92 @@ public class KeyInfoImpl extends AbstractXMLObject implements KeyInfo {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected KeyInfoImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KeyInfoImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         indexedChildren = new IndexedXMLObjectChildrenList<>(this);
     }
     
     /** {@inheritDoc} */
-    public String getID() {
-        return this.id;
+    @Nullable public String getID() {
+        return id;
     }
 
     /** {@inheritDoc} */
-    public void setID(final String newID) {
-        final String oldID = this.id;
-        this.id = prepareForAssignment(this.id, newID);
-        registerOwnID(oldID, this.id);
+    public void setID(@Nullable final String newID) {
+        final String oldID = id;
+        this.id = prepareForAssignment(id, newID);
+        registerOwnID(oldID, id);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getXMLObjects() {
         return indexedChildren;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects(final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) indexedChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<KeyName> getKeyNames() {
+    @Nonnull @Live public List<KeyName> getKeyNames() {
         return (List<KeyName>) indexedChildren.subList(KeyName.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<KeyValue> getKeyValues() {
+    @Nonnull @Live public List<KeyValue> getKeyValues() {
         return (List<KeyValue>) indexedChildren.subList(KeyValue.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<DEREncodedKeyValue> getDEREncodedKeyValues() {
+    @Nonnull @Live public List<DEREncodedKeyValue> getDEREncodedKeyValues() {
         return (List<DEREncodedKeyValue>) indexedChildren.subList(DEREncodedKeyValue.DEFAULT_ELEMENT_NAME);
     }
     
     /** {@inheritDoc} */
-    public List<RetrievalMethod> getRetrievalMethods() {
+    @Nonnull @Live public List<RetrievalMethod> getRetrievalMethods() {
         return (List<RetrievalMethod>) indexedChildren.subList(RetrievalMethod.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<KeyInfoReference> getKeyInfoReferences() {
+    @Nonnull @Live public List<KeyInfoReference> getKeyInfoReferences() {
         return (List<KeyInfoReference>) indexedChildren.subList(KeyInfoReference.DEFAULT_ELEMENT_NAME);
     }
     
     /** {@inheritDoc} */
-    public List<X509Data> getX509Datas() {
+    @Nonnull @Live public List<X509Data> getX509Datas() {
         return (List<X509Data>) indexedChildren.subList(X509Data.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<PGPData> getPGPDatas() {
+    @Nonnull @Live public List<PGPData> getPGPDatas() {
         return (List<PGPData>) indexedChildren.subList(PGPData.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<SPKIData> getSPKIDatas() {
+    @Nonnull @Live public List<SPKIData> getSPKIDatas() {
         return (List<SPKIData>) indexedChildren.subList(SPKIData.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<MgmtData> getMgmtDatas() {
+    @Nonnull @Live public List<MgmtData> getMgmtDatas() {
         return (List<MgmtData>) indexedChildren.subList(MgmtData.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<AgreementMethod> getAgreementMethods() {
+    @Nonnull @Live public List<AgreementMethod> getAgreementMethods() {
         return (List<AgreementMethod>) indexedChildren.subList(AgreementMethod.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<EncryptedKey> getEncryptedKeys() {
+    @Nonnull @Live public List<EncryptedKey> getEncryptedKeys() {
         return (List<EncryptedKey>) indexedChildren.subList(EncryptedKey.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(indexedChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(indexedChildren);
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoMarshaller.java
index ea3863fe3..abd97bb7c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class KeyInfoMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final KeyInfo keyInfo = (KeyInfo ) xmlObject;
 
         if (keyInfo.getID() != null) {
@@ -38,7 +41,7 @@ public class KeyInfoMarshaller extends AbstractXMLSignatureMarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, KeyInfo.ID_ATTRIB_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceBuilder.java
index 407936c9e..353e1aefa 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.KeyInfoReference;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
@@ -28,20 +31,14 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 public class KeyInfoReferenceBuilder extends AbstractXMLObjectBuilder<KeyInfoReference>
     implements XMLSignatureBuilder<KeyInfoReference> {
 
-    /**
-     * Constructor.
-     */
-    public KeyInfoReferenceBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyInfoReference buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public KeyInfoReference buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyInfoReferenceImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyInfoReference buildObject() {
+    @Nonnull public KeyInfoReference buildObject() {
         return buildObject(SignatureConstants.XMLSIG11_NS, KeyInfoReference.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceImpl.java
index a493114d9..b631fea86 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceImpl.java
@@ -19,20 +19,26 @@ package org.opensaml.xmlsec.signature.impl;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.KeyInfoReference;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
  * Concrete implementation of {@link KeyInfoReference}.
  */
 public class KeyInfoReferenceImpl extends AbstractXMLObject implements KeyInfoReference {
     
     /** Id attribute value. */
-    private String id;
+    @Nullable private String id;
     
     /** URI attribute value. */
-    private String uri;
+    @Nullable private String uri;
     
     /**
      * Constructor.
@@ -41,35 +47,35 @@ public class KeyInfoReferenceImpl extends AbstractXMLObject implements KeyInfoRe
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected KeyInfoReferenceImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected KeyInfoReferenceImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getID() {
+    @Nullable public String getID() {
         return id;
     }
 
     /** {@inheritDoc} */
-    public void setID(final String newID) {
+    public void setID(@Nullable final String newID) {
         final String oldID = id;
         id = prepareForAssignment(id, newID);
         registerOwnID(oldID, id);
     }
     
     /** {@inheritDoc} */
-    public String getURI() {
+    @Nullable public String getURI() {
         return uri;
     }
 
     /** {@inheritDoc} */
-    public void setURI(final String newURI) {
+    public void setURI(@Nullable final String newURI) {
         uri = prepareForAssignment(uri, newURI);
     }
     
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         // no children
         return null;
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceMarshaller.java
index c9a3f37ba..a85acd8d1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class KeyInfoReferenceMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final KeyInfoReference ref = (KeyInfoReference) xmlObject;
 
         if (ref.getID() != null) {
@@ -42,7 +45,7 @@ public class KeyInfoReferenceMarshaller extends AbstractXMLSignatureMarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void marshallAttributeIDness(final XMLObject xmlObject, final Element domElement)
+    protected void marshallAttributeIDness(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
 
         XMLObjectSupport.marshallAttributeIDness(null, KeyInfoReference.ID_ATTRIB_NAME, domElement, true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceUnmarshaller.java
index 5119001be..be6922c04 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoReferenceUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.KeyInfoReference;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class KeyInfoReferenceUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final KeyInfoReference ref = (KeyInfoReference) xmlObject;
 
         if (attribute.getLocalName().equals(KeyInfoReference.ID_ATTRIB_NAME)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoUnmarshaller.java
index b1d977887..0a8d04eb4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyInfoUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.KeyInfo;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class KeyInfoUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final KeyInfo keyInfo = (KeyInfo) xmlObject;
 
         if (attribute.getLocalName().equals(KeyInfo.ID_ATTRIB_NAME)) {
@@ -40,8 +43,8 @@ public class KeyInfoUnmarshaller extends AbstractXMLSignatureUnmarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final KeyInfo keyInfo = (KeyInfo) parentXMLObject;
 
         // KeyInfoType contains a range of specific types, but also
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameBuilder.java
index 6fd298ba4..1261a31b1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.KeyName;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.KeyName}.
+ * Builder of {@link KeyName}.
  */
 public class KeyNameBuilder extends AbstractXMLObjectBuilder<KeyName> implements XMLSignatureBuilder<KeyName> {
 
-    /**
-     * Constructor.
-     */
-    public KeyNameBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyName buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeyName buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyNameImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyName buildObject() {
+    @Nonnull public KeyName buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, KeyName.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameImpl.java
index f5ba9bd6f..d7088c2e6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyNameImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.signature.KeyName;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.KeyName}.
+ * Concrete implementation of {@link KeyName}.
  */
 public class KeyNameImpl extends XSStringImpl implements KeyName {
 
@@ -32,7 +35,8 @@ public class KeyNameImpl extends XSStringImpl implements KeyName {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected KeyNameImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KeyNameImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueBuilder.java
index cbec830e8..d31f003cb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.KeyValue;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.KeyValue}.
+ * Builder of {@link KeyValue}.
  */
 public class KeyValueBuilder extends AbstractXMLObjectBuilder<KeyValue> implements XMLSignatureBuilder<KeyValue> {
 
-    /**
-     * Constructor.
-     */
-    public KeyValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public KeyValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeyValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public KeyValue buildObject() {
+    @Nonnull public KeyValue buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, KeyValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueImpl.java
index fb798e8fc..8c6382ef7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueImpl.java
@@ -18,9 +18,11 @@
 package org.opensaml.xmlsec.signature.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.DHKeyValue;
@@ -29,25 +31,29 @@ import org.opensaml.xmlsec.signature.ECKeyValue;
 import org.opensaml.xmlsec.signature.KeyValue;
 import org.opensaml.xmlsec.signature.RSAKeyValue;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.KeyValue}.
+ * Concrete implementation of {@link KeyValue}.
  */
 public class KeyValueImpl extends AbstractXMLObject implements KeyValue {
  
     /** DHKeyValue child element. */
-    private DHKeyValue dhKeyValue;
+    @Nullable private DHKeyValue dhKeyValue;
     
     /** DSAKeyValue child element. */
-    private DSAKeyValue dsaKeyValue;
+    @Nullable private DSAKeyValue dsaKeyValue;
     
     /** RSAKeyValue child element. */
-    private RSAKeyValue rsaKeyValue;
+    @Nullable private RSAKeyValue rsaKeyValue;
 
     /** ECKeyValue child element. */
-    private ECKeyValue ecKeyValue;
+    @Nullable private ECKeyValue ecKeyValue;
     
     /** Wildcard <any> XMLObject child element. */
-    private XMLObject unknownXMLObject;
+    @Nullable private XMLObject unknownXMLObject;
 
     /**
      * Constructor.
@@ -56,62 +62,63 @@ public class KeyValueImpl extends AbstractXMLObject implements KeyValue {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected KeyValueImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KeyValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public DHKeyValue getDHKeyValue() {
+    @Nullable public DHKeyValue getDHKeyValue() {
         return dhKeyValue;
     }
 
     /** {@inheritDoc} */
-    public void setDHKeyValue(final DHKeyValue newDHKeyValue) {
+    public void setDHKeyValue(@Nullable final DHKeyValue newDHKeyValue) {
         dhKeyValue = prepareForAssignment(dhKeyValue, newDHKeyValue);
     }
 
     /** {@inheritDoc} */
-    public DSAKeyValue getDSAKeyValue() {
+    @Nullable public DSAKeyValue getDSAKeyValue() {
         return dsaKeyValue;
     }
 
     /** {@inheritDoc} */
-    public void setDSAKeyValue(final DSAKeyValue newDSAKeyValue) {
+    public void setDSAKeyValue(@Nullable final DSAKeyValue newDSAKeyValue) {
         dsaKeyValue = prepareForAssignment(dsaKeyValue, newDSAKeyValue);
     }
 
     /** {@inheritDoc} */
-    public RSAKeyValue getRSAKeyValue() {
+    @Nullable public RSAKeyValue getRSAKeyValue() {
         return rsaKeyValue;
     }
 
     /** {@inheritDoc} */
-    public void setRSAKeyValue(final RSAKeyValue newRSAKeyValue) {
+    public void setRSAKeyValue(@Nullable final RSAKeyValue newRSAKeyValue) {
         rsaKeyValue = prepareForAssignment(rsaKeyValue, newRSAKeyValue);
     }
 
     /** {@inheritDoc} */
-    public ECKeyValue getECKeyValue() {
+    @Nullable public ECKeyValue getECKeyValue() {
         return ecKeyValue;
     }
 
     /** {@inheritDoc} */
-    public void setECKeyValue(final ECKeyValue newECKeyValue) {
+    public void setECKeyValue(@Nullable final ECKeyValue newECKeyValue) {
         ecKeyValue = prepareForAssignment(ecKeyValue, newECKeyValue);
     }
     
     /** {@inheritDoc} */
-    public XMLObject getUnknownXMLObject() {
+    @Nullable public XMLObject getUnknownXMLObject() {
         return unknownXMLObject;
     }
 
     /** {@inheritDoc} */
-    public void setUnknownXMLObject(final XMLObject newXMLObject) {
+    public void setUnknownXMLObject(@Nullable final XMLObject newXMLObject) {
         unknownXMLObject = prepareForAssignment(unknownXMLObject, newXMLObject);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (dsaKeyValue != null) {
@@ -130,11 +137,7 @@ public class KeyValueImpl extends AbstractXMLObject implements KeyValue {
             children.add(unknownXMLObject);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueUnmarshaller.java
index d1d76fc22..e8e83399d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/KeyValueUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.encryption.DHKeyValue;
@@ -31,8 +33,8 @@ import org.opensaml.xmlsec.signature.RSAKeyValue;
 public class KeyValueUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final KeyValue keyValue = (KeyValue) parentXMLObject;
 
         if (childXMLObject instanceof DSAKeyValue) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataBuilder.java
index 5f4a72409..d395635b3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.MgmtData;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.MgmtData}.
+ * Builder of {@link MgmtData}.
  */
 public class MgmtDataBuilder extends AbstractXMLObjectBuilder<MgmtData> implements XMLSignatureBuilder<MgmtData> {
 
-    /**
-     * Constructor.
-     */
-    public MgmtDataBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public MgmtData buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public MgmtData buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new MgmtDataImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public MgmtData buildObject() {
+    @Nonnull public MgmtData buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, MgmtData.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataImpl.java
index 5dfbda727..5c4cd5811 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/MgmtDataImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.signature.MgmtData;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.MgmtData}.
+ * Concrete implementation of {@link MgmtData}.
  */
 public class MgmtDataImpl extends XSStringImpl implements MgmtData {
 
@@ -32,7 +35,8 @@ public class MgmtDataImpl extends XSStringImpl implements MgmtData {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected MgmtDataImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected MgmtDataImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusBuilder.java
index 528aec24e..9732e1a8e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.Modulus;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Modulus}.
+ * Builder of {@link Modulus}.
  */
 public class ModulusBuilder extends AbstractXMLObjectBuilder<Modulus> implements XMLSignatureBuilder<Modulus> {
 
-    /**
-     * Constructor.
-     */
-    public ModulusBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Modulus buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Modulus buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ModulusImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Modulus buildObject() {
+    @Nonnull public Modulus buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Modulus.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusImpl.java
index 1695febac..32c3c4a87 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/ModulusImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.Modulus;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Exponent}.
+ * Concrete implementation of {@link Modulus}.
  */
 public class ModulusImpl extends CryptoBinaryImpl implements Modulus {
 
@@ -31,7 +34,8 @@ public class ModulusImpl extends CryptoBinaryImpl implements Modulus {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected ModulusImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected ModulusImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveBuilder.java
index 0253aed54..445b1a461 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.NamedCurve;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
@@ -28,19 +31,14 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 public class NamedCurveBuilder extends AbstractXMLObjectBuilder<NamedCurve>
     implements XMLSignatureBuilder<NamedCurve> {
 
-    /**
-     * Constructor.
-     */
-    public NamedCurveBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public NamedCurve buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public NamedCurve buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new NamedCurveImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public NamedCurve buildObject() {
+    @Nonnull public NamedCurve buildObject() {
         return buildObject(SignatureConstants.XMLSIG11_NS, NamedCurve.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveImpl.java
index 06fabecce..07b8c103e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveImpl.java
@@ -19,17 +19,23 @@ package org.opensaml.xmlsec.signature.impl;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.NamedCurve;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
  * Concrete implementation of {@link NamedCurve}.
  */
 public class NamedCurveImpl extends AbstractXMLObject implements NamedCurve {
     
     /** URI attribute value. */
-    private String uri;
+    @Nullable private String uri;
     
     /**
      * Constructor.
@@ -38,22 +44,23 @@ public class NamedCurveImpl extends AbstractXMLObject implements NamedCurve {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected NamedCurveImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected NamedCurveImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getURI() {
+    @Nullable public String getURI() {
         return uri;
     }
 
     /** {@inheritDoc} */
-    public void setURI(final String newURI) {
+    public void setURI(@Nullable final String newURI) {
         uri = prepareForAssignment(uri, newURI);
     }
     
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         // no children
         return null;
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveMarshaller.java
index ceee85a91..bc7b4945e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.signature.NamedCurve;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class NamedCurveMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final NamedCurve nc = (NamedCurve) xmlObject;
 
         if (nc.getURI() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveUnmarshaller.java
index cbc641209..29f298b06 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/NamedCurveUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.NamedCurve;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class NamedCurveUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final NamedCurve nc = (NamedCurve) xmlObject;
 
         if (attribute.getLocalName().equals(NamedCurve.URI_ATTRIB_NAME)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PBuilder.java
index 281fc3dcc..e6ce096eb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.P;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.P}.
+ * Builder of {@link P}.
  */
 public class PBuilder extends AbstractXMLObjectBuilder<P> implements XMLSignatureBuilder<P> {
 
-    /**
-     * Constructor.
-     */
-    public PBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public P buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public P buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public P buildObject() {
+    @Nonnull public P buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, P.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataBuilder.java
index 2a5ee3bf7..3a36e8651 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.PGPData;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.PGPData}.
+ * Builder of {@link PGPData}.
  */
 public class PGPDataBuilder extends AbstractXMLObjectBuilder<PGPData> implements XMLSignatureBuilder<PGPData> {
 
-    /**
-     * Constructor.
-     */
-    public PGPDataBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PGPData buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PGPData buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PGPDataImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PGPData buildObject() {
+    @Nonnull public PGPData buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, PGPData.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataImpl.java
index 11703cdf1..2d55288fd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataImpl.java
@@ -18,9 +18,10 @@
 package org.opensaml.xmlsec.signature.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -30,19 +31,24 @@ import org.opensaml.xmlsec.signature.PGPData;
 import org.opensaml.xmlsec.signature.PGPKeyID;
 import org.opensaml.xmlsec.signature.PGPKeyPacket;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.PGPData}.
+ * Concrete implementation of {@link PGPData}.
  */
 public class PGPDataImpl extends AbstractXMLObject implements PGPData {
     
     /** PGPKeyID child element value. */
-    private PGPKeyID pgpKeyID;
+    @Nullable private PGPKeyID pgpKeyID;
     
     /** PGPKeyPacket child element value. */
-    private PGPKeyPacket pgpKeyPacket;
+    @Nullable private PGPKeyPacket pgpKeyPacket;
     
     /** List of <any> wildcard XMLObject children. */
-    private final IndexedXMLObjectChildrenList<XMLObject> xmlChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> xmlChildren;
 
     /**
      * Constructor.
@@ -51,42 +57,45 @@ public class PGPDataImpl extends AbstractXMLObject implements PGPData {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected PGPDataImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PGPDataImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         xmlChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public PGPKeyID getPGPKeyID() {
-        return this.pgpKeyID;
+    @Nullable public PGPKeyID getPGPKeyID() {
+        return pgpKeyID;
     }
 
     /** {@inheritDoc} */
-    public void setPGPKeyID(final PGPKeyID newPGPKeyID) {
-        this.pgpKeyID = prepareForAssignment(this.pgpKeyID, newPGPKeyID);
+    public void setPGPKeyID(@Nullable final PGPKeyID newPGPKeyID) {
+        pgpKeyID = prepareForAssignment(pgpKeyID, newPGPKeyID);
     }
 
     /** {@inheritDoc} */
-    public PGPKeyPacket getPGPKeyPacket() {
-        return this.pgpKeyPacket;
+    @Nullable public PGPKeyPacket getPGPKeyPacket() {
+        return pgpKeyPacket;
     }
 
     /** {@inheritDoc} */
-    public void setPGPKeyPacket(final PGPKeyPacket newPGPKeyPacket) {
-        this.pgpKeyPacket = prepareForAssignment(this.pgpKeyPacket, newPGPKeyPacket);
+    public void setPGPKeyPacket(@Nullable final PGPKeyPacket newPGPKeyPacket) {
+        pgpKeyPacket = prepareForAssignment(pgpKeyPacket, newPGPKeyPacket);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return xmlChildren;
     }
+    
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(final QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) xmlChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (pgpKeyID != null) {
@@ -95,13 +104,10 @@ public class PGPDataImpl extends AbstractXMLObject implements PGPData {
         if (pgpKeyPacket != null) {
             children.add(pgpKeyPacket);
         }
-        children.addAll(xmlChildren);
         
-        if (children.size() == 0) {
-            return null;
-        }
+        children.addAll(xmlChildren);
         
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataUnmarshaller.java
index d5da29203..be4a9e691 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPDataUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.PGPData;
@@ -29,8 +31,8 @@ import org.opensaml.xmlsec.signature.PGPKeyPacket;
 public class PGPDataUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final PGPData pgpData = (PGPData) parentXMLObject;
 
         if (childXMLObject instanceof PGPKeyID) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDBuilder.java
index 673013309..6596758f2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.PGPKeyID;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.PGPKeyID}.
+ * Builder of {@link PGPKeyID}.
  */
 public class PGPKeyIDBuilder extends AbstractXMLObjectBuilder<PGPKeyID> implements XMLSignatureBuilder<PGPKeyID> {
 
-    /**
-     * Constructor.
-     */
-    public PGPKeyIDBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PGPKeyID buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PGPKeyID buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PGPKeyIDImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PGPKeyID buildObject() {
+    @Nonnull public PGPKeyID buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, PGPKeyID.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDImpl.java
index 345eba88e..b37814efa 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyIDImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.signature.PGPKeyID;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.PGPKeyID}.
+ * Concrete implementation of {@link PGPKeyID}.
  */
 public class PGPKeyIDImpl extends XSBase64BinaryImpl implements PGPKeyID {
 
@@ -32,7 +35,8 @@ public class PGPKeyIDImpl extends XSBase64BinaryImpl implements PGPKeyID {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected PGPKeyIDImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PGPKeyIDImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketBuilder.java
index b4cb25e79..b231ac350 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.PGPKeyPacket;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.PGPKeyPacket}.
+ * Builder of {@link PGPKeyPacket}.
  */
 public class PGPKeyPacketBuilder extends AbstractXMLObjectBuilder<PGPKeyPacket> implements
         XMLSignatureBuilder<PGPKeyPacket> {
 
-    /**
-     * Constructor.
-     */
-    public PGPKeyPacketBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PGPKeyPacket buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PGPKeyPacket buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PGPKeyPacketImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PGPKeyPacket buildObject() {
+    @Nonnull public PGPKeyPacket buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, PGPKeyPacket.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketImpl.java
index f92743131..00c57c84a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PGPKeyPacketImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.signature.PGPKeyPacket;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.PGPKeyPacket}.
+ * Concrete implementation of {@link PGPKeyPacket}.
  */
 public class PGPKeyPacketImpl extends XSBase64BinaryImpl implements PGPKeyPacket {
 
@@ -32,7 +35,8 @@ public class PGPKeyPacketImpl extends XSBase64BinaryImpl implements PGPKeyPacket
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected PGPKeyPacketImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PGPKeyPacketImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PImpl.java
index 4dc8ef701..241a183b8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.P;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.P}.
+ * Concrete implementation of {@link P}.
  */
 public class PImpl extends CryptoBinaryImpl implements P {
 
@@ -31,7 +34,8 @@ public class PImpl extends CryptoBinaryImpl implements P {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected PImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterBuilder.java
index 779cfd5e7..a0a614bcb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.PgenCounter;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.PgenCounter}.
+ * Builder of {@link PgenCounter}.
  */
 public class PgenCounterBuilder extends AbstractXMLObjectBuilder<PgenCounter> implements
         XMLSignatureBuilder<PgenCounter> {
 
-    /**
-     * Constructor.
-     */
-    public PgenCounterBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public PgenCounter buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PgenCounter buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PgenCounterImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PgenCounter buildObject() {
+    @Nonnull public PgenCounter buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, PgenCounter.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterImpl.java
index 331cb425c..66a2658a8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PgenCounterImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.PgenCounter;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.PgenCounter}.
+ * Concrete implementation of {@link PgenCounter}.
  */
 public class PgenCounterImpl extends CryptoBinaryImpl implements PgenCounter {
 
@@ -31,7 +34,8 @@ public class PgenCounterImpl extends CryptoBinaryImpl implements PgenCounter {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected PgenCounterImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PgenCounterImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyBuilder.java
index 90c8bb7b7..059c7887a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.PublicKey;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
@@ -25,22 +28,16 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 /**
  * Builder of {@link PublicKey}.
  */
-public class PublicKeyBuilder extends AbstractXMLObjectBuilder<PublicKey>
-    implements XMLSignatureBuilder<PublicKey> {
-
-    /**
-     * Constructor.
-     */
-    public PublicKeyBuilder() {
-    }
+public class PublicKeyBuilder extends AbstractXMLObjectBuilder<PublicKey> implements XMLSignatureBuilder<PublicKey> {
 
     /** {@inheritDoc} */
-    public PublicKey buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public PublicKey buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new PublicKeyImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public PublicKey buildObject() {
+    @Nonnull public PublicKey buildObject() {
         return buildObject(SignatureConstants.XMLSIG11_NS, PublicKey.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyImpl.java
index 3ddbf0300..e63287a04 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/PublicKeyImpl.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.PublicKey;
 
 /**
@@ -31,7 +34,8 @@ public class PublicKeyImpl extends ECPointTypeImpl implements PublicKey {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected PublicKeyImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected PublicKeyImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QBuilder.java
index 05bc47a04..47242c577 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.Q;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Q}.
+ * Builder of {@link Q}.
  */
 public class QBuilder extends AbstractXMLObjectBuilder<Q> implements XMLSignatureBuilder<Q> {
 
-    /**
-     * Constructor.
-     */
-    public QBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Q buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Q buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new QImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Q buildObject() {
+    @Nonnull public Q buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Q.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QImpl.java
index 3d67e8ba7..2c404731f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/QImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.Q;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Q}.
+ * Concrete implementation of {@link Q}.
  */
 public class QImpl extends CryptoBinaryImpl implements Q {
 
@@ -31,7 +34,8 @@ public class QImpl extends CryptoBinaryImpl implements Q {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected QImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected QImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueBuilder.java
index 05ba857e3..7adc45c1f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.RSAKeyValue;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.RSAKeyValue}.
+ * Builder of {@link RSAKeyValue}.
  */
 public class RSAKeyValueBuilder extends AbstractXMLObjectBuilder<RSAKeyValue> implements
         XMLSignatureBuilder<RSAKeyValue> {
 
-    /**
-     * Constructor.
-     */
-    public RSAKeyValueBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public RSAKeyValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public RSAKeyValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new RSAKeyValueImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public RSAKeyValue buildObject() {
+    @Nonnull public RSAKeyValue buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, RSAKeyValue.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueImpl.java
index e778aee53..b837c1b95 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueImpl.java
@@ -18,25 +18,31 @@
 package org.opensaml.xmlsec.signature.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.Exponent;
 import org.opensaml.xmlsec.signature.Modulus;
 import org.opensaml.xmlsec.signature.RSAKeyValue;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.RSAKeyValue}.
+ * Concrete implementation of {@link RSAKeyValue}.
  */
 public class RSAKeyValueImpl extends AbstractXMLObject implements RSAKeyValue {
     
     /** Modulus child element value. */
-    private Modulus modulus;
+    @Nullable private Modulus modulus;
     
     /** Exponent child element value. */
-    private Exponent exponent;
+    @Nullable private Exponent exponent;
 
     /**
      * Constructor.
@@ -45,33 +51,34 @@ public class RSAKeyValueImpl extends AbstractXMLObject implements RSAKeyValue {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected RSAKeyValueImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected RSAKeyValueImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Modulus getModulus() {
+    @Nullable public Modulus getModulus() {
         return this.modulus;
     }
 
     /** {@inheritDoc} */
-    public void setModulus(final Modulus newModulus) {
+    public void setModulus(@Nullable final Modulus newModulus) {
         this.modulus = prepareForAssignment(this.modulus, newModulus);
     }
 
     /** {@inheritDoc} */
-    public Exponent getExponent() {
+    @Nullable public Exponent getExponent() {
         return this.exponent;
     }
 
     /** {@inheritDoc} */
-    public void setExponent(final Exponent newExponent) {
+    public void setExponent(@Nullable final Exponent newExponent) {
         this.exponent = prepareForAssignment(this.exponent, newExponent);
 
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (modulus != null) {
@@ -81,11 +88,7 @@ public class RSAKeyValueImpl extends AbstractXMLObject implements RSAKeyValue {
             children.add(exponent);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueUnmarshaller.java
index 127286dac..92b6f90ff 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RSAKeyValueUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.Exponent;
@@ -29,8 +31,8 @@ import org.opensaml.xmlsec.signature.RSAKeyValue;
 public class RSAKeyValueUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final RSAKeyValue keyValue = (RSAKeyValue) parentXMLObject;
 
         if (childXMLObject instanceof Modulus) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodBuilder.java
index 819939252..75076b808 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.RetrievalMethod;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.RetrievalMethod}.
+ * Builder of {@link RetrievalMethod}.
  */
 public class RetrievalMethodBuilder extends AbstractXMLObjectBuilder<RetrievalMethod> implements
         XMLSignatureBuilder<RetrievalMethod> {
 
-    /**
-     * Constructor.
-     */
-    public RetrievalMethodBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public RetrievalMethod buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public RetrievalMethod buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new RetrievalMethodImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public RetrievalMethod buildObject() {
+    @Nonnull public RetrievalMethod buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, RetrievalMethod.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodImpl.java
index 6ddface23..a7c18d7db 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodImpl.java
@@ -17,28 +17,33 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.RetrievalMethod;
 import org.opensaml.xmlsec.signature.Transforms;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.RetrievalMethod}.
+ * Concrete implementation of {@link RetrievalMethod}.
  */
 public class RetrievalMethodImpl extends AbstractXMLObject implements RetrievalMethod {
     
     /** URI attribute value. */
-    private String uri;
+    @Nullable private String uri;
     
     /** Type attribute value. */
-    private String type;
+    @Nullable private String type;
     
     /** Transforms attribute value. */
-    private Transforms transforms;
+    @Nullable private Transforms transforms;
 
     /**
      * Constructor.
@@ -47,54 +52,48 @@ public class RetrievalMethodImpl extends AbstractXMLObject implements RetrievalM
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected RetrievalMethodImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected RetrievalMethodImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getURI() {
-        return this.uri;
+    @Nullable public String getURI() {
+        return uri;
     }
 
     /** {@inheritDoc} */
-    public void setURI(final String newURI) {
-        this.uri = prepareForAssignment(this.uri, newURI);
+    public void setURI(@Nullable final String newURI) {
+        uri = prepareForAssignment(this.uri, newURI);
     }
 
     /** {@inheritDoc} */
-    public String getType() {
-        return this.type;
+    @Nullable public String getType() {
+        return type;
     }
 
     /** {@inheritDoc} */
-    public void setType(final String newType) {
-        this.type = prepareForAssignment(this.type, newType);
+    public void setType(@Nullable final String newType) {
+        type = prepareForAssignment(type, newType);
     }
 
     /** {@inheritDoc} */
-    public Transforms getTransforms() {
-        return this.transforms;
+    @Nullable public Transforms getTransforms() {
+        return transforms;
     }
 
     /** {@inheritDoc} */
-    public void setTransforms(final Transforms newTransforms) {
-        this.transforms = prepareForAssignment(this.transforms, newTransforms);
+    public void setTransforms(@Nullable final Transforms newTransforms) {
+        transforms = prepareForAssignment(transforms, newTransforms);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         if (transforms != null) {
-            children.add(transforms);
-        }
-        
-        if (children.size() == 0) {
-            return null;
+            return CollectionSupport.singletonList(transforms);
         }
         
-        return Collections.unmodifiableList(children);
+        return null;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodMarshaller.java
index 3944b01d0..09f4f46ae 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.signature.RetrievalMethod;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class RetrievalMethodMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final RetrievalMethod rm = (RetrievalMethod) xmlObject;
 
         if (rm.getURI() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodUnmarshaller.java
index 53bb1bc49..20d783781 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/RetrievalMethodUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.RetrievalMethod;
@@ -29,7 +31,8 @@ import org.w3c.dom.Attr;
 public class RetrievalMethodUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final RetrievalMethod rm = (RetrievalMethod) xmlObject;
 
         if (attribute.getLocalName().equals(RetrievalMethod.URI_ATTRIB_NAME)) {
@@ -42,8 +45,8 @@ public class RetrievalMethodUnmarshaller extends AbstractXMLSignatureUnmarshalle
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final RetrievalMethod rm = (RetrievalMethod) parentXMLObject;
 
         if (childXMLObject instanceof Transforms) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataBuilder.java
index 836cb93b0..1af089697 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.SPKIData;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.SPKIData}.
+ * Builder of {@link SPKIData}.
  */
 public class SPKIDataBuilder extends AbstractXMLObjectBuilder<SPKIData> implements XMLSignatureBuilder<SPKIData> {
 
-    /**
-     * Constructor.
-     */
-    public SPKIDataBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public SPKIData buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public SPKIData buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SPKIDataImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public SPKIData buildObject() {
+    @Nonnull public SPKIData buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, SPKIData.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataImpl.java
index 467271d61..0f8832aef 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataImpl.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -29,13 +29,19 @@ import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.xmlsec.signature.SPKIData;
 import org.opensaml.xmlsec.signature.SPKISexp;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.SPKIData}.
+ * Concrete implementation of {@link SPKIData}.
  */
+ at SuppressWarnings("unchecked")
 public class SPKIDataImpl extends AbstractXMLObject implements SPKIData {
     
     /** The list of XMLObject child elements. */
-    private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
 
     /**
      * Constructor.
@@ -44,37 +50,30 @@ public class SPKIDataImpl extends AbstractXMLObject implements SPKIData {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected SPKIDataImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected SPKIDataImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         indexedChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getXMLObjects() {
         return this.indexedChildren;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects(final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) this.indexedChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<SPKISexp> getSPKISexps() {
+    @Nonnull @Live public List<SPKISexp> getSPKISexps() {
         return (List<SPKISexp>) this.indexedChildren.subList(SPKISexp.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(indexedChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(indexedChildren);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataUnmarshaller.java
index cf5c1c152..b4c25e35b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKIDataUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.SPKIData;
@@ -27,8 +29,8 @@ import org.opensaml.xmlsec.signature.SPKIData;
 public class SPKIDataUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final SPKIData spkiData = (SPKIData) parentXMLObject;
 
         // SPKIData contains an unbounded sequence of pairs of a single SPKISexp
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpBuilder.java
index c58d67af1..76999b0d3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.SPKISexp;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.SPKISexp}.
+ * Builder of {@link SPKISexp}.
  */
 public class SPKISexpBuilder extends AbstractXMLObjectBuilder<SPKISexp> implements XMLSignatureBuilder<SPKISexp> {
 
-    /**
-     * Constructor.
-     */
-    public SPKISexpBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public SPKISexp buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public SPKISexp buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SPKISexpImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public SPKISexp buildObject() {
+    @Nonnull public SPKISexp buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, SPKISexp.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpImpl.java
index 3ef487dd6..c26a6f480 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SPKISexpImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.signature.SPKISexp;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.SPKISexp}.
+ * Concrete implementation of {@link SPKISexp}.
  */
 public class SPKISexpImpl extends XSBase64BinaryImpl implements SPKISexp {
 
@@ -32,7 +35,8 @@ public class SPKISexpImpl extends XSBase64BinaryImpl implements SPKISexp {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected SPKISexpImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected SPKISexpImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedBuilder.java
index 12f990896..cb41d05fe 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.Seed;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Seed}.
+ * Builder of {@link Seed}.
  */
 public class SeedBuilder extends AbstractXMLObjectBuilder<Seed> implements XMLSignatureBuilder<Seed> {
 
-    /**
-     * Constructor.
-     */
-    public SeedBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Seed buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Seed buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SeedImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Seed buildObject() {
+    @Nonnull public Seed buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Seed.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedImpl.java
index f2058a129..199a35913 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SeedImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.Seed;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Seed}.
+ * Concrete implementation of {@link Seed}.
  */
 public class SeedImpl extends CryptoBinaryImpl implements Seed {
 
@@ -31,7 +34,8 @@ public class SeedImpl extends CryptoBinaryImpl implements Seed {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected SeedImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected SeedImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureBuilder.java
index 4920a8bb3..6439bfe55 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureBuilder.java
@@ -17,33 +17,29 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
+import org.opensaml.xmlsec.signature.Signature;
+import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Signature}s.
+ * Builder of {@link Signature}.
  */
-public class SignatureBuilder extends AbstractXMLObjectBuilder<SignatureImpl> {
-
-    /**
-     * Constructor.
-     */
-    public SignatureBuilder() {
+public class SignatureBuilder extends AbstractXMLObjectBuilder<Signature> implements XMLSignatureBuilder<Signature> {
 
+    /** {@inheritDoc} */
+    @Nonnull public Signature buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
+        return new SignatureImpl(namespaceURI, localName, namespacePrefix);
     }
 
-    /**
-     * Creates the XMLObject with the default prefix and local name.
-     * 
-     * @return the Signature object
-     */
-    public SignatureImpl buildObject() {
+    /** {@inheritDoc} */
+    @Nonnull public Signature buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, SignatureImpl.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
 
-    /** {@inheritDoc} */
-    public SignatureImpl buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
-        return new SignatureImpl(namespaceURI, localName, namespacePrefix);
-    }
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureImpl.java
index d770e9ae3..648d1a2b1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureImpl.java
@@ -17,10 +17,12 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.Collections;
 import java.util.LinkedList;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.apache.xml.security.signature.XMLSignature;
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
@@ -29,31 +31,35 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.ContentReference;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
  * XMLObject representing an enveloped or detached XML Digital Signature, version 20020212, Signature element.
  */
 public class SignatureImpl extends AbstractXMLObject implements Signature {
 
     /** Canonicalization algorithm used in signature. */
-    private String canonicalizationAlgorithm;
+    @Nullable private String canonicalizationAlgorithm;
 
     /** Algorithm used to generate the signature. */
-    private String signatureAlgorithm;
+    @Nullable private String signatureAlgorithm;
 
     /** Optional HMAC output length parameter to the signature algorithm. */
-    private Integer hmacOutputLength;
+    @Nullable private Integer hmacOutputLength;
 
     /** Key used to sign the signature. */
-    private Credential signingCredential;
+    @Nullable private Credential signingCredential;
 
     /** Public key information to embed in the signature. */
-    private KeyInfo keyInfo;
+    @Nullable private KeyInfo keyInfo;
 
     /** References to content to be signed. */
-    private List<ContentReference> contentReferences;
+    @Nonnull private List<ContentReference> contentReferences;
 
     /** Constructed Apache XML Security signature object. */
-    private XMLSignature xmlSignature;
+    @Nullable private XMLSignature xmlSignature;
 
     /**
      * Constructor.
@@ -62,71 +68,72 @@ public class SignatureImpl extends AbstractXMLObject implements Signature {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected SignatureImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected SignatureImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         contentReferences = new LinkedList<>();
     }
 
     /** {@inheritDoc} */
-    public String getCanonicalizationAlgorithm() {
+    @Nullable public String getCanonicalizationAlgorithm() {
         return canonicalizationAlgorithm;
     }
 
     /** {@inheritDoc} */
-    public void setCanonicalizationAlgorithm(final String newAlgorithm) {
+    public void setCanonicalizationAlgorithm(@Nullable final String newAlgorithm) {
         canonicalizationAlgorithm = prepareForAssignment(canonicalizationAlgorithm, newAlgorithm);
     }
 
     /** {@inheritDoc} */
-    public String getSignatureAlgorithm() {
+    @Nullable public String getSignatureAlgorithm() {
         return signatureAlgorithm;
     }
 
     /** {@inheritDoc} */
-    public void setSignatureAlgorithm(final String newAlgorithm) {
+    public void setSignatureAlgorithm(@Nullable final String newAlgorithm) {
         signatureAlgorithm = prepareForAssignment(signatureAlgorithm, newAlgorithm);
     }
 
     /** {@inheritDoc} */
-    public Integer getHMACOutputLength() {
+    @Nullable public Integer getHMACOutputLength() {
         return hmacOutputLength;
     }
 
     /** {@inheritDoc} */
-    public void setHMACOutputLength(final Integer length) {
+    public void setHMACOutputLength(@Nullable final Integer length) {
         hmacOutputLength = prepareForAssignment(hmacOutputLength, length);
     }
 
     /** {@inheritDoc} */
-    public Credential getSigningCredential() {
+    @Nullable public Credential getSigningCredential() {
         return signingCredential;
     }
 
     /** {@inheritDoc} */
-    public void setSigningCredential(final Credential newCredential) {
+    public void setSigningCredential(@Nullable final Credential newCredential) {
         signingCredential = prepareForAssignment(signingCredential, newCredential);
     }
 
     /** {@inheritDoc} */
-    public KeyInfo getKeyInfo() {
+    @Nullable public KeyInfo getKeyInfo() {
         return keyInfo;
     }
 
     /** {@inheritDoc} */
-    public void setKeyInfo(final KeyInfo newKeyInfo) {
+    public void setKeyInfo(@Nullable final KeyInfo newKeyInfo) {
         keyInfo = prepareForAssignment(keyInfo, newKeyInfo);
     }
 
     /** {@inheritDoc} */
-    public List<ContentReference> getContentReferences() {
+    @Nonnull @Live public List<ContentReference> getContentReferences() {
         // TODO worry about detecting changes and releasing this object's and parent's DOM?
         // would need something like an Observable list/collection impl or something similar
         return contentReferences;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        return Collections.EMPTY_LIST;
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return null;
     }
 
     /** {@inheritDoc} */
@@ -140,6 +147,7 @@ public class SignatureImpl extends AbstractXMLObject implements Signature {
         // DOM for its children too
         if (keyInfo != null) {
             keyInfo.releaseChildrenDOM(true);
+            assert keyInfo != null;
             keyInfo.releaseDOM();
         }
     }
@@ -149,7 +157,7 @@ public class SignatureImpl extends AbstractXMLObject implements Signature {
      * 
      * @return an Apache XML Security signature object
      */
-    public XMLSignature getXMLSignature() {
+    @Nullable public XMLSignature getXMLSignature() {
         return xmlSignature;
     }
 
@@ -158,7 +166,8 @@ public class SignatureImpl extends AbstractXMLObject implements Signature {
      * 
      * @param signature an Apache XML Security signature object
      */
-    public void setXMLSignature(final XMLSignature signature) {
+    public void setXMLSignature(@Nullable final XMLSignature signature) {
         xmlSignature = prepareForAssignment(xmlSignature, signature);
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureMarshaller.java
index 561a9e238..3aa4c49c4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureMarshaller.java
@@ -33,10 +33,10 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.ContentReference;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.xml.ElementSupport;
 
 /**
@@ -47,7 +47,7 @@ import net.shibboleth.shared.xml.ElementSupport;
 public class SignatureMarshaller implements Marshaller {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(SignatureMarshaller.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(SignatureMarshaller.class);
 
     /** Constructor. */
     public SignatureMarshaller() {
@@ -58,7 +58,7 @@ public class SignatureMarshaller implements Marshaller {
     }
 
     /** {@inheritDoc} */
-    public Element marshall(final XMLObject xmlObject) throws MarshallingException {
+    @Nonnull public Element marshall(@Nonnull final XMLObject xmlObject) throws MarshallingException {
         try {
             final Document document = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
             return marshall(xmlObject, document);
@@ -68,7 +68,8 @@ public class SignatureMarshaller implements Marshaller {
     }
 
     /** {@inheritDoc} */
-    public Element marshall(final XMLObject xmlObject, final Element parentElement) throws MarshallingException {
+    @Nonnull public Element marshall(@Nonnull final XMLObject xmlObject, @Nonnull final Element parentElement)
+            throws MarshallingException {
         final Element signatureElement =
                 createSignatureElement((SignatureImpl) xmlObject, parentElement.getOwnerDocument());
         ElementSupport.appendChildElement(parentElement, signatureElement);
@@ -76,7 +77,8 @@ public class SignatureMarshaller implements Marshaller {
     }
 
     /** {@inheritDoc} */
-    public Element marshall(final XMLObject xmlObject, final Document document) throws MarshallingException {
+    @Nonnull public Element marshall(@Nonnull final XMLObject xmlObject, @Nonnull final Document document)
+            throws MarshallingException {
         final Element signatureElement = createSignatureElement((SignatureImpl) xmlObject, document);
 
         final Element documentRoot = document.getDocumentElement();
@@ -99,19 +101,23 @@ public class SignatureMarshaller implements Marshaller {
      * 
      * @throws MarshallingException thrown if the signature can not be constructed
      */
-    @Nonnull private Element createSignatureElement(final Signature signature, final Document document)
-            throws MarshallingException {
+    @Nonnull private Element createSignatureElement(@Nonnull final Signature signature,
+            @Nonnull final Document document) throws MarshallingException {
         log.debug("Starting to marshall {}", signature.getElementQName());
 
+        final String sigAlg = signature.getSignatureAlgorithm();
+        if (sigAlg == null) {
+            throw new MarshallingException("No signature algorithm set");
+        }
+        
         try {
             log.debug("Creating XMLSignature object");
             XMLSignature dsig = null;
-            if (signature.getHMACOutputLength() != null && AlgorithmSupport.isHMAC(signature.getSignatureAlgorithm())) {
-                dsig = new XMLSignature(document, "", signature.getSignatureAlgorithm(), signature
-                        .getHMACOutputLength(), signature.getCanonicalizationAlgorithm());
+            final Integer hmaclen = signature.getHMACOutputLength();
+            if (hmaclen != null && AlgorithmSupport.isHMAC(sigAlg)) {
+                dsig = new XMLSignature(document, "", sigAlg, hmaclen, signature.getCanonicalizationAlgorithm());
             } else {
-                dsig = new XMLSignature(document, "", signature.getSignatureAlgorithm(), signature
-                        .getCanonicalizationAlgorithm());
+                dsig = new XMLSignature(document, "", sigAlg, signature.getCanonicalizationAlgorithm());
             }
 
             log.debug("Adding content to XMLSignature.");
@@ -122,10 +128,11 @@ public class SignatureMarshaller implements Marshaller {
             log.debug("Creating Signature DOM element");
             final Element signatureElement = dsig.getElement();
 
-            if (signature.getKeyInfo() != null) {
+            final KeyInfo keyInfo = signature.getKeyInfo();
+            if (keyInfo != null) {
                 final Marshaller keyInfoMarshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory()
-                        .getMarshaller(KeyInfo.DEFAULT_ELEMENT_NAME);
-                keyInfoMarshaller.marshall(signature.getKeyInfo(), signatureElement);
+                        .ensureMarshaller(KeyInfo.DEFAULT_ELEMENT_NAME);
+                keyInfoMarshaller.marshall(keyInfo, signatureElement);
             }
 
             ((SignatureImpl) signature).setXMLSignature(dsig);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureUnmarshaller.java
index 973d49f13..5eb88cf1e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/SignatureUnmarshaller.java
@@ -22,6 +22,7 @@ import java.util.List;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 
@@ -36,16 +37,15 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.w3c.dom.Element;
 
 /**
- * An unmarshaller for {@link org.opensaml.xmlsec.signature.Signature} objects.
+ * An unmarshaller for {@link Signature} objects.
  */
 public class SignatureUnmarshaller implements Unmarshaller {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(SignatureUnmarshaller.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(SignatureUnmarshaller.class);
 
     /** Constructor. */
     public SignatureUnmarshaller() {
@@ -56,7 +56,7 @@ public class SignatureUnmarshaller implements Unmarshaller {
     }
 
     /** {@inheritDoc} */
-    public Signature unmarshall(@Nonnull final Element signatureElement) throws UnmarshallingException {
+    @Nonnull public Signature unmarshall(@Nonnull final Element signatureElement) throws UnmarshallingException {
         log.debug("Starting to unmarshall Apache XML-Security-based SignatureImpl element");
 
         final SignatureImpl signature =
@@ -79,7 +79,7 @@ public class SignatureUnmarshaller implements Unmarshaller {
             if (xmlSecKeyInfo != null) {
                 log.debug("Adding KeyInfo to Signature");
                 final Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory()
-                        .getUnmarshaller(xmlSecKeyInfo.getElement());
+                        .ensureUnmarshaller(xmlSecKeyInfo.getElement());
                 final KeyInfo keyInfo = (KeyInfo) unmarshaller.unmarshall(xmlSecKeyInfo.getElement());
                 signature.setKeyInfo(keyInfo);
             }
@@ -98,7 +98,7 @@ public class SignatureUnmarshaller implements Unmarshaller {
      * @param signatureMethodElement the ds:SignatureMethod element
      * @return the HMAC output length value, or null if not present
      */
-    private Integer getHMACOutputLengthValue(@Nullable final Element signatureMethodElement) {
+    @Nullable private Integer getHMACOutputLengthValue(@Nullable final Element signatureMethodElement) {
         if (signatureMethodElement == null) {
             return null;
         }
@@ -115,4 +115,5 @@ public class SignatureUnmarshaller implements Unmarshaller {
         }
         return null;
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformBuilder.java
index ad4064094..af35183f5 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.Transform;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Transform}.
+ * Builder of {@link Transform}.
  */
 public class TransformBuilder extends AbstractXMLObjectBuilder<Transform> implements XMLSignatureBuilder<Transform> {
 
-    /**
-     * Constructor.
-     */
-    public TransformBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Transform buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Transform buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new TransformImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Transform buildObject() {
+    @Nonnull public Transform buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Transform.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformImpl.java
index 133471a71..317e8644b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformImpl.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -29,16 +29,22 @@ import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.xmlsec.signature.Transform;
 import org.opensaml.xmlsec.signature.XPath;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Transform}.
+ * Concrete implementation of {@link Transform}.
  */
+ at SuppressWarnings("unchecked")
 public class TransformImpl extends AbstractXMLObject implements Transform {
     
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /** "any" children. */
-    private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
 
     /**
      * Constructor.
@@ -47,47 +53,40 @@ public class TransformImpl extends AbstractXMLObject implements Transform {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected TransformImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected TransformImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         indexedChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
-        return this.algorithm;
+    @Nullable public String getAlgorithm() {
+        return algorithm;
     }
 
     /** {@inheritDoc} */
-    public void setAlgorithm(final String newAlgorithm) {
-        this.algorithm = prepareForAssignment(this.algorithm, newAlgorithm);
+    public void setAlgorithm(@Nullable final String newAlgorithm) {
+        algorithm = prepareForAssignment(algorithm, newAlgorithm);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getAllChildren() {
+    @Nonnull @Live public List<XMLObject> getAllChildren() {
         return indexedChildren ;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects(final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) indexedChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XPath> getXPaths() {
+    @Nonnull @Live public List<XPath> getXPaths() {
         return (List<XPath>) indexedChildren.subList(XPath.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(indexedChildren);
-        
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(indexedChildren);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformMarshaller.java
index 51a661a23..a65c80d1f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.xmlsec.signature.Transform;
@@ -28,7 +30,8 @@ import org.w3c.dom.Element;
 public class TransformMarshaller extends AbstractXMLSignatureMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final Transform transform = (Transform) xmlObject;
 
         if (transform.getAlgorithm() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformUnmarshaller.java
index 04be20e22..0a3c7566f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.Transform;
@@ -28,7 +30,8 @@ import org.w3c.dom.Attr;
 public class TransformUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final Transform transform = (Transform) xmlObject;
 
         if (attribute.getLocalName().equals(Transform.ALGORITHM_ATTRIB_NAME)) {
@@ -39,8 +42,8 @@ public class TransformUnmarshaller extends AbstractXMLSignatureUnmarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final Transform transform = (Transform) parentXMLObject;
 
         // Has <any> open content model + XPath children
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsBuilder.java
index c367adca1..86efad2bd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.Transforms;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Transforms}.
+ * Builder of {@link Transforms}.
  */
 public class TransformsBuilder extends AbstractXMLObjectBuilder<Transforms> implements XMLSignatureBuilder<Transforms> {
 
-    /**
-     * Constructor.
-     */
-    public TransformsBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Transforms buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Transforms buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new TransformsImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Transforms buildObject() {
+    @Nonnull public Transforms buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Transforms.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsImpl.java
index 739d7db40..8d1beaff5 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsImpl.java
@@ -17,23 +17,29 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
 import org.opensaml.xmlsec.signature.Transform;
 import org.opensaml.xmlsec.signature.Transforms;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Transforms}.
+ * Concrete implementation of {@link Transforms}.
  */
 public class TransformsImpl extends AbstractXMLObject implements Transforms {
     
     /** Transform children. */
-    private final XMLObjectChildrenList<Transform> transforms;
+    @Nonnull private final XMLObjectChildrenList<Transform> transforms;
 
     /**
      * Constructor.
@@ -42,27 +48,21 @@ public class TransformsImpl extends AbstractXMLObject implements Transforms {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected TransformsImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected TransformsImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         transforms = new XMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public List<Transform> getTransforms() {
-        return this.transforms;
+    @Nonnull @Live public List<Transform> getTransforms() {
+        return transforms;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        
-        children.addAll(transforms);
-        
-        if (children.size() == 0) {
-            return null;
-        }
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(transforms);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsUnmarshaller.java
index 7020be9cc..76a185082 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/TransformsUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.Transform;
@@ -28,8 +30,8 @@ import org.opensaml.xmlsec.signature.Transforms;
 public class TransformsUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final Transforms transforms = (Transforms) parentXMLObject;
 
         if (childXMLObject instanceof Transform) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLBuilder.java
index 73cf24db2..d9316c155 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509CRL;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509CRL}.
+ * Builder of {@link X509CRL}.
  */
 public class X509CRLBuilder extends AbstractXMLObjectBuilder<X509CRL> implements XMLSignatureBuilder<X509CRL> {
 
-    /**
-     * Constructor.
-     */
-    public X509CRLBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509CRL buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public X509CRL buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509CRLImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509CRL buildObject() {
+    @Nonnull public X509CRL buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509CRL.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLImpl.java
index 0a1442d99..12ee32e2e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CRLImpl.java
@@ -19,13 +19,16 @@ package org.opensaml.xmlsec.signature.impl;
 
 import java.lang.ref.Cleaner;
 import java.lang.ref.Cleaner.Cleanable;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.IndexingObjectStore;
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.CleanerSupport;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -36,17 +39,17 @@ import org.opensaml.xmlsec.signature.X509CRL;
 public class X509CRLImpl extends AbstractXMLObject implements X509CRL {
 
     /** Class-level index of Base64 encoded CRL values. */
-    private static final IndexingObjectStore<String> B64_CRL_STORE = new IndexingObjectStore<>();
+    @Nonnull private static final IndexingObjectStore<String> B64_CRL_STORE = new IndexingObjectStore<>();
 
     /** The {@link Cleaner} instance to use. */
-    private static final Cleaner CLEANER = CleanerSupport.getInstance(X509CRLImpl.class);
+    @Nonnull private static final Cleaner CLEANER = CleanerSupport.getInstance(X509CRLImpl.class);
 
     /** The {@link Cleanable} representing the current instance's CRL value, as represented by the
      * current <code>b64CRLIndex</code> field value. */
-    private Cleaner.Cleanable cleanable;
+    @Nullable private Cleaner.Cleanable cleanable;
 
     /** Index to a stored Base64 encoded CRL. */
-    private String b64CRLIndex;
+    @Nullable private String b64CRLIndex;
 
     /**
      * Constructor.
@@ -55,17 +58,18 @@ public class X509CRLImpl extends AbstractXMLObject implements X509CRL {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509CRLImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected X509CRLImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getValue() {
+    @Nullable public String getValue() {
         return B64_CRL_STORE.get(b64CRLIndex);
     }
 
     /** {@inheritDoc} */
-    public void setValue(final String newValue) {
+    public void setValue(@Nullable final String newValue) {
         // Dump our cached DOM if the new value really is new
         final String currentCRL = B64_CRL_STORE.get(b64CRLIndex);
         final String newCRL = prepareForAssignment(currentCRL, newValue);
@@ -84,9 +88,8 @@ public class X509CRLImpl extends AbstractXMLObject implements X509CRL {
     }
 
     /** {@inheritDoc} */
-    @Override
-    public List<XMLObject> getOrderedChildren() {
-        return Collections.emptyList();
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return null;
     }
 
     /**
@@ -95,15 +98,15 @@ public class X509CRLImpl extends AbstractXMLObject implements X509CRL {
     static class CleanerState implements Runnable {
 
         /** The index to remove from the store. */
-        private String index;
+        @Nonnull private final String index;
 
         /**
          * Constructor.
          *
-         * @param idx the index in the {@link X509CertificateImpl#B64_CERT_STORE}.
+         * @param idx the index in the {@link X509CRLImpl#B64_CRL_STORE}.
          */
         public CleanerState(@Nonnull final String idx) {
-            index = idx;
+            index = Constraint.isNotNull(idx, "Index cannot be null");
         }
 
         /** {@inheritDoc} */
@@ -112,4 +115,5 @@ public class X509CRLImpl extends AbstractXMLObject implements X509CRL {
         }
 
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateBuilder.java
index 21fbe8789..07ce73b5f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509Certificate;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509Certificate}.
+ * Builder of {@link X509Certificate}.
  */
 public class X509CertificateBuilder extends AbstractXMLObjectBuilder<X509Certificate> implements
         XMLSignatureBuilder<X509Certificate> {
 
-    /**
-     * Constructor.
-     */
-    public X509CertificateBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509Certificate buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public X509Certificate buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509CertificateImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509Certificate buildObject() {
+    @Nonnull public X509Certificate buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509Certificate.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateImpl.java
index 5c75dc0e4..01f9e3bd0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509CertificateImpl.java
@@ -19,34 +19,37 @@ package org.opensaml.xmlsec.signature.impl;
 
 import java.lang.ref.Cleaner;
 import java.lang.ref.Cleaner.Cleanable;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.X509Certificate;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.IndexingObjectStore;
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.CleanerSupport;
 
 /** Concrete implementation of {@link X509Certificate}. */
 public class X509CertificateImpl extends AbstractXMLObject implements X509Certificate {
 
     /** Class-level index of Base64 encoded cert values. */
-    private static final IndexingObjectStore<String> B64_CERT_STORE = new IndexingObjectStore<>();
+    @Nonnull private static final IndexingObjectStore<String> B64_CERT_STORE = new IndexingObjectStore<>();
 
     /** The {@link Cleaner} instance to use. */
-    private static final Cleaner CLEANER = CleanerSupport.getInstance(X509CertificateImpl.class);
+    @Nonnull private static final Cleaner CLEANER = CleanerSupport.getInstance(X509CertificateImpl.class);
 
     /** The {@link Cleanable} representing the current instance's cert value, as represented by the
      * current <code>b64CertIndex</code> field value. */
-    private Cleaner.Cleanable cleanable;
+    @Nullable private Cleaner.Cleanable cleanable;
 
     /** Index to a stored Base64 encoded cert. */
-    private String b64CertIndex;
+    @Nullable private String b64CertIndex;
 
     /**
      * Constructor.
@@ -55,20 +58,18 @@ public class X509CertificateImpl extends AbstractXMLObject implements X509Certif
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509CertificateImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected X509CertificateImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    @Override
-    public String getValue() {
+    @Nullable public String getValue() {
         return B64_CERT_STORE.get(b64CertIndex);
     }
 
     /** {@inheritDoc} */
-    @Override
-    public void setValue(final String newValue) {
+    public void setValue(@Nullable final String newValue) {
         // Dump our cached DOM if the new value really is new
         final String currentCert = B64_CERT_STORE.get(b64CertIndex);
         final String newCert = prepareForAssignment(currentCert, newValue);
@@ -87,9 +88,8 @@ public class X509CertificateImpl extends AbstractXMLObject implements X509Certif
     }
 
     /** {@inheritDoc} */
-    @Override
-    public List<XMLObject> getOrderedChildren() {
-        return Collections.emptyList();
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return null;
     }
     
     /**
@@ -98,7 +98,7 @@ public class X509CertificateImpl extends AbstractXMLObject implements X509Certif
     static class CleanerState implements Runnable {
 
         /** The index to remove from the store. */
-        private String index;
+        @Nonnull private final String index;
 
         /**
          * Constructor.
@@ -106,7 +106,7 @@ public class X509CertificateImpl extends AbstractXMLObject implements X509Certif
          * @param idx the index in the {@link X509CertificateImpl#B64_CERT_STORE}.
          */
         public CleanerState(@Nonnull final String idx) {
-            index = idx;
+            index = Constraint.isNotNull(idx, "Index cannot be null");
         }
 
         /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataBuilder.java
index 811fb9dd3..4b3c1c470 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509Data;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509Data}.
+ * Builder of {@link X509Data}.
  */
 public class X509DataBuilder extends AbstractXMLObjectBuilder<X509Data> implements XMLSignatureBuilder<X509Data> {
 
-    /**
-     * Constructor.
-     */
-    public X509DataBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509Data buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public X509Data buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509DataImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509Data buildObject() {
+    @Nonnull public X509Data buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509Data.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataImpl.java
index e03ce43b2..97bde757d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataImpl.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -34,11 +34,17 @@ import org.opensaml.xmlsec.signature.X509IssuerSerial;
 import org.opensaml.xmlsec.signature.X509SKI;
 import org.opensaml.xmlsec.signature.X509SubjectName;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /** Concrete implementation of {@link X509Data}. */
+ at SuppressWarnings("unchecked")
 public class X509DataImpl extends AbstractXMLObject implements X509Data {
 
     /** The list of XMLObject child elements. */
-    private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
+    @Nonnull private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
 
     /**
      * Constructor.
@@ -47,62 +53,56 @@ public class X509DataImpl extends AbstractXMLObject implements X509Data {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509DataImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected X509DataImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         indexedChildren = new IndexedXMLObjectChildrenList<>(this);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects() {
+    @Nonnull public List<XMLObject> getXMLObjects() {
         return indexedChildren;
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getXMLObjects(final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) indexedChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<X509IssuerSerial> getX509IssuerSerials() {
+    @Nonnull @Live public List<X509IssuerSerial> getX509IssuerSerials() {
         return (List<X509IssuerSerial>) indexedChildren.subList(X509IssuerSerial.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<X509SKI> getX509SKIs() {
+    @Nonnull @Live public List<X509SKI> getX509SKIs() {
         return (List<X509SKI>) indexedChildren.subList(X509SKI.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<X509SubjectName> getX509SubjectNames() {
+    @Nonnull @Live public List<X509SubjectName> getX509SubjectNames() {
         return (List<X509SubjectName>) indexedChildren.subList(X509SubjectName.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<X509Certificate> getX509Certificates() {
+    @Nonnull @Live public List<X509Certificate> getX509Certificates() {
         return (List<X509Certificate>) indexedChildren.subList(X509Certificate.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<X509CRL> getX509CRLs() {
+    @Nonnull @Live public List<X509CRL> getX509CRLs() {
         return (List<X509CRL>) indexedChildren.subList(X509CRL.DEFAULT_ELEMENT_NAME);
     }
 
     /** {@inheritDoc} */
-    public List<X509Digest> getX509Digests() {
+    @Nonnull @Live public List<X509Digest> getX509Digests() {
         return (List<X509Digest>) indexedChildren.subList(X509Digest.DEFAULT_ELEMENT_NAME);
     }
     
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-
-        children.addAll(indexedChildren);
-
-        if (children.size() == 0) {
-            return null;
-        }
-
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        
+        return CollectionSupport.copyToList(indexedChildren);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataUnmarshaller.java
index e8e182ee7..40c00d4da 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DataUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.X509Data;
@@ -27,8 +29,8 @@ import org.opensaml.xmlsec.signature.X509Data;
 public class X509DataUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final X509Data x509Data = (X509Data) parentXMLObject;
 
         // X509Data contains a range of specific types, but also
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestBuilder.java
index 3247adf06..328a0fb36 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestBuilder.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509Digest;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
@@ -25,22 +28,16 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 /**
  * Builder of {@link X509Digest}.
  */
-public class X509DigestBuilder extends AbstractXMLObjectBuilder<X509Digest>
-    implements XMLSignatureBuilder<X509Digest> {
-
-    /**
-     * Constructor.
-     */
-    public X509DigestBuilder() {
-    }
+public class X509DigestBuilder extends AbstractXMLObjectBuilder<X509Digest> implements XMLSignatureBuilder<X509Digest> {
 
     /** {@inheritDoc} */
-    public X509Digest buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public X509Digest buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509DigestImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509Digest buildObject() {
+    @Nonnull public X509Digest buildObject() {
         return buildObject(SignatureConstants.XMLSIG11_NS, X509Digest.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG11_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestImpl.java
index 9fe233526..96633f1a5 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestImpl.java
@@ -17,6 +17,9 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.signature.X509Digest;
 
@@ -26,7 +29,7 @@ import org.opensaml.xmlsec.signature.X509Digest;
 public class X509DigestImpl extends XSBase64BinaryImpl implements X509Digest {
 
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /**
      * Constructor.
@@ -35,17 +38,18 @@ public class X509DigestImpl extends XSBase64BinaryImpl implements X509Digest {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509DigestImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected X509DigestImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nullable public String getAlgorithm() {
         return algorithm;
     }
 
     /** {@inheritDoc} */
-    public void setAlgorithm(final String newAlgorithm) {
+    public void setAlgorithm(@Nullable final String newAlgorithm) {
         algorithm = prepareForAssignment(algorithm, newAlgorithm);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestMarshaller.java
index e15faef7a..62621127e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestMarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryMarshaller;
@@ -29,7 +31,8 @@ import org.w3c.dom.Element;
 public class X509DigestMarshaller extends XSBase64BinaryMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         final X509Digest xd = (X509Digest) xmlObject;
 
         if (xd.getAlgorithm() != null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestUnmarshaller.java
index 1fbd8ae98..5b65a45c9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509DigestUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryUnmarshaller;
@@ -29,7 +31,8 @@ import org.w3c.dom.Attr;
 public class X509DigestUnmarshaller extends XSBase64BinaryUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         final X509Digest xd = (X509Digest) xmlObject;
 
         if (attribute.getLocalName().equals(X509Digest.ALGORITHM_ATTRIB_NAME)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameBuilder.java
index 262a0dcf4..0a0de5b3a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameBuilder.java
@@ -17,30 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509IssuerName;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509IssuerName}.
+ * Builder of {@link X509IssuerName}.
  */
 public class X509IssuerNameBuilder extends AbstractXMLObjectBuilder<X509IssuerName> implements
         XMLSignatureBuilder<X509IssuerName> {
 
-    /**
-     * Constructor.
-     */
-    public X509IssuerNameBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509IssuerName buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public X509IssuerName buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509IssuerNameImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509IssuerName buildObject() {
+    @Nonnull public X509IssuerName buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509IssuerName.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameImpl.java
index ceadc8e0b..1ed366363 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerNameImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.signature.X509IssuerName;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.X509IssuerName}.
+ * Concrete implementation of {@link X509IssuerName}.
  */
 public class X509IssuerNameImpl extends XSStringImpl implements X509IssuerName {
 
@@ -32,8 +35,8 @@ public class X509IssuerNameImpl extends XSStringImpl implements X509IssuerName {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509IssuerNameImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected X509IssuerNameImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialBuilder.java
index c130dfaeb..30ea09d19 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509IssuerSerial;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509IssuerSerial}.
+ * Builder of {@link X509IssuerSerial}.
  */
 public class X509IssuerSerialBuilder extends AbstractXMLObjectBuilder<X509IssuerSerial> implements
         XMLSignatureBuilder<X509IssuerSerial> {
 
-    /**
-     * Constructor.
-     */
-    public X509IssuerSerialBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509IssuerSerial buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public X509IssuerSerial buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509IssuerSerialImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509IssuerSerial buildObject() {
+    @Nonnull public X509IssuerSerial buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509IssuerSerial.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialImpl.java
index 9548381da..f909f0d10 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialImpl.java
@@ -18,25 +18,31 @@
 package org.opensaml.xmlsec.signature.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.X509IssuerName;
 import org.opensaml.xmlsec.signature.X509IssuerSerial;
 import org.opensaml.xmlsec.signature.X509SerialNumber;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.X509IssuerSerial}.
+ * Concrete implementation of {@link X509IssuerSerial}.
  */
 public class X509IssuerSerialImpl extends AbstractXMLObject implements X509IssuerSerial {
     
     /** X509IssuerName child element. */
-    private X509IssuerName issuerName;
+    @Nullable private X509IssuerName issuerName;
     
     /** X509SerialNumber child element. */
-    private X509SerialNumber serialNumber;
+    @Nullable private X509SerialNumber serialNumber;
 
     /**
      * Constructor.
@@ -45,33 +51,33 @@ public class X509IssuerSerialImpl extends AbstractXMLObject implements X509Issue
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509IssuerSerialImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected X509IssuerSerialImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509IssuerName getX509IssuerName() {
+    @Nullable public X509IssuerName getX509IssuerName() {
         return this.issuerName;
     }
 
     /** {@inheritDoc} */
-    public void setX509IssuerName(final X509IssuerName newX509IssuerName) {
+    public void setX509IssuerName(@Nullable final X509IssuerName newX509IssuerName) {
         this.issuerName = prepareForAssignment(this.issuerName, newX509IssuerName);
     }
 
     /** {@inheritDoc} */
-    public X509SerialNumber getX509SerialNumber() {
+    @Nullable public X509SerialNumber getX509SerialNumber() {
         return this.serialNumber;
     }
 
     /** {@inheritDoc} */
-    public void setX509SerialNumber(final X509SerialNumber newX509SerialNumber) {
+    public void setX509SerialNumber(@Nullable final X509SerialNumber newX509SerialNumber) {
         this.serialNumber = prepareForAssignment(this.serialNumber, newX509SerialNumber);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (issuerName != null) {
@@ -81,11 +87,7 @@ public class X509IssuerSerialImpl extends AbstractXMLObject implements X509Issue
             children.add(serialNumber);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialUnmarshaller.java
index 5a7e92ffe..be321eef7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509IssuerSerialUnmarshaller.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.xmlsec.signature.X509IssuerName;
@@ -29,8 +31,8 @@ import org.opensaml.xmlsec.signature.X509SerialNumber;
 public class X509IssuerSerialUnmarshaller extends AbstractXMLSignatureUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         final X509IssuerSerial keyValue = (X509IssuerSerial) parentXMLObject;
 
         if (childXMLObject instanceof X509IssuerName) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIBuilder.java
index 3e8934337..a825834d0 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509SKI;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509SKI}.
+ * Builder of {@link X509SKI}.
  */
 public class X509SKIBuilder extends AbstractXMLObjectBuilder<X509SKI> implements XMLSignatureBuilder<X509SKI> {
 
-    /**
-     * Constructor.
-     */
-    public X509SKIBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509SKI buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public X509SKI buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509SKIImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509SKI buildObject() {
+    @Nonnull public X509SKI buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509SKI.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIImpl.java
index 2df5537f8..1ecb66637 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SKIImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSBase64BinaryImpl;
 import org.opensaml.xmlsec.signature.X509SKI;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.X509SKI}.
+ * Concrete implementation of {@link X509SKI}.
  */
 public class X509SKIImpl extends XSBase64BinaryImpl implements X509SKI {
 
@@ -32,7 +35,8 @@ public class X509SKIImpl extends XSBase64BinaryImpl implements X509SKI {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509SKIImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected X509SKIImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberBuilder.java
index 8f11c5c19..06cd3ee87 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberBuilder.java
@@ -17,34 +17,30 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509SerialNumber;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509SerialNumber}.
+ * Builder of {@link X509SerialNumber}.
  */
 public class X509SerialNumberBuilder extends AbstractXMLObjectBuilder<X509SerialNumber> implements
         XMLSignatureBuilder<X509SerialNumber> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public X509SerialNumberBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509SerialNumber buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public X509SerialNumber buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509SerialNumberImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509SerialNumber buildObject() {
+    @Nonnull public X509SerialNumber buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509SerialNumber.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberImpl.java
index c548d9179..31dd3d7a4 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberImpl.java
@@ -20,17 +20,23 @@ package org.opensaml.xmlsec.signature.impl;
 import java.math.BigInteger;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.signature.X509SerialNumber;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.X509SerialNumber}.
+ * Concrete implementation of {@link X509SerialNumber}.
  */
 public class X509SerialNumberImpl extends AbstractXMLObject implements X509SerialNumber {
     
     /** The serial number value. */
-    private BigInteger value;
+    @Nullable private BigInteger value;
 
     /**
      * Constructor.
@@ -39,27 +45,27 @@ public class X509SerialNumberImpl extends AbstractXMLObject implements X509Seria
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509SerialNumberImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected X509SerialNumberImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public BigInteger getValue() {
+    @Nullable public BigInteger getValue() {
         return value;
     }
 
     /** {@inheritDoc} */
-    public void setValue(final BigInteger newValue) {
+    public void setValue(@Nullable final BigInteger newValue) {
         value = prepareForAssignment(value, newValue);
     }
     
     /**
      * {@inheritDoc}
      */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         // no children
         return null;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberMarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberMarshaller.java
index 7ba158e62..273ed873e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberMarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberMarshaller.java
@@ -17,6 +17,10 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import java.math.BigInteger;
+
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.AbstractXMLObjectMarshaller;
 import org.opensaml.core.xml.io.MarshallingException;
@@ -31,17 +35,20 @@ import net.shibboleth.shared.xml.ElementSupport;
 public class X509SerialNumberMarshaller extends AbstractXMLObjectMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
+            throws MarshallingException {
         // no attributes
     }
 
     /** {@inheritDoc} */
-    protected void marshallElementContent(final XMLObject xmlObject, final Element domElement)
+    protected void marshallElementContent(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement)
             throws MarshallingException {
         final X509SerialNumber x509SerialNumber = (X509SerialNumber) xmlObject;
         
-        if (x509SerialNumber.getValue() != null) {
-            ElementSupport.appendTextContent(domElement, x509SerialNumber.getValue().toString());
+        final BigInteger serial = x509SerialNumber.getValue();
+        if (serial != null) {
+            ElementSupport.appendTextContent(domElement, serial.toString());
         }
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberUnmarshaller.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberUnmarshaller.java
index 7723e420a..e21b4da9d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberUnmarshaller.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SerialNumberUnmarshaller.java
@@ -19,6 +19,8 @@ package org.opensaml.xmlsec.signature.impl;
 
 import java.math.BigInteger;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.AbstractXMLObjectUnmarshaller;
 import org.opensaml.core.xml.io.UnmarshallingException;
@@ -33,18 +35,19 @@ import com.google.common.base.Strings;
 public class X509SerialNumberUnmarshaller extends AbstractXMLObjectUnmarshaller {
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
-            throws UnmarshallingException {
+    protected void processChildElement(@Nonnull final XMLObject parentXMLObject,
+            @Nonnull final XMLObject childXMLObject) throws UnmarshallingException {
         // no children
     }
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(@Nonnull final XMLObject xmlObject, @Nonnull final Attr attribute)
+            throws UnmarshallingException {
         //no attributes
     }
 
     /** {@inheritDoc} */
-    protected void processElementContent(final XMLObject xmlObject, final String elementContent) {
+    protected void processElementContent(@Nonnull final XMLObject xmlObject, @Nonnull final String elementContent) {
         final X509SerialNumber x509SerialNumber = (X509SerialNumber) xmlObject;
         
         if(!Strings.isNullOrEmpty(elementContent)){
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameBuilder.java
index db4463d5a..12eff4e92 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameBuilder.java
@@ -17,31 +17,28 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.X509SubjectName;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.X509SubjectName}.
+ * Builder of {@link X509SubjectName}.
  */
 public class X509SubjectNameBuilder extends AbstractXMLObjectBuilder<X509SubjectName> implements
         XMLSignatureBuilder<X509SubjectName> {
 
-    /**
-     * Constructor.
-     */
-    public X509SubjectNameBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public X509SubjectName buildObject(final String namespaceURI, final String localName,
-            final String namespacePrefix) {
+    @Nonnull public X509SubjectName buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new X509SubjectNameImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public X509SubjectName buildObject() {
+    @Nonnull public X509SubjectName buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, X509SubjectName.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameImpl.java
index 10c967944..11c362970 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/X509SubjectNameImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.signature.X509SubjectName;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.X509SubjectName}.
+ * Concrete implementation of {@link X509SubjectName}.
  */
 public class X509SubjectNameImpl extends XSStringImpl implements X509SubjectName {
 
@@ -32,8 +35,8 @@ public class X509SubjectNameImpl extends XSStringImpl implements X509SubjectName
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected X509SubjectNameImpl(final String namespaceURI, final String elementLocalName,
-            final String namespacePrefix) {
+    protected X509SubjectNameImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathBuilder.java
index 2872b5bde..4a97ebb73 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathBuilder.java
@@ -17,29 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.XPath;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.XPath}.
+ * Builder of {@link XPath}.
  */
 public class XPathBuilder extends AbstractXMLObjectBuilder<XPath> implements XMLSignatureBuilder<XPath> {
 
-    /**
-     * Constructor.
-     */
-    public XPathBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public XPath buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public XPath buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new XPathImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public XPath buildObject() {
+    @Nonnull public XPath buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, XPath.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathImpl.java
index 94b7fb088..cf2715905 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/XPathImpl.java
@@ -17,11 +17,14 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.schema.impl.XSStringImpl;
 import org.opensaml.xmlsec.signature.XPath;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.XPath}.
+ * Concrete implementation of {@link XPath}.
  */
 public class XPathImpl extends XSStringImpl implements XPath {
 
@@ -32,7 +35,8 @@ public class XPathImpl extends XSStringImpl implements XPath {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected XPathImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected XPathImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YBuilder.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YBuilder.java
index 9b80039e4..85951ffea 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YBuilder.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YBuilder.java
@@ -17,30 +17,27 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.opensaml.xmlsec.signature.Y;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
- * Builder of {@link org.opensaml.xmlsec.signature.Y}.
+ * Builder of {@link Y}.
  */
 public class YBuilder extends AbstractXMLObjectBuilder<Y> implements XMLSignatureBuilder<Y> {
 
-    /**
-     * Constructor.
-     * 
-     */
-    public YBuilder() {
-    }
-
     /** {@inheritDoc} */
-    public Y buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Y buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new YImpl(namespaceURI, localName, namespacePrefix);
     }
 
     /** {@inheritDoc} */
-    public Y buildObject() {
+    @Nonnull public Y buildObject() {
         return buildObject(SignatureConstants.XMLSIG_NS, Y.DEFAULT_ELEMENT_LOCAL_NAME,
                 SignatureConstants.XMLSIG_PREFIX);
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YImpl.java
index ac142e7e2..a1b8ad170 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/impl/YImpl.java
@@ -17,10 +17,13 @@
 
 package org.opensaml.xmlsec.signature.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.xmlsec.signature.Y;
 
 /**
- * Concrete implementation of {@link org.opensaml.xmlsec.signature.Y}.
+ * Concrete implementation of {@link Y}.
  */
 public class YImpl extends CryptoBinaryImpl implements Y {
 
@@ -31,7 +34,8 @@ public class YImpl extends CryptoBinaryImpl implements Y {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected YImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected YImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list