[java-opensaml] branch main updated: IDP-2069 - Null Handling Task

Scott Cantor cantor.2 at osu.edu
Fri Mar 31 16:13:48 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=efe377e90a744e05888b589959be766b61855e91

The following commit(s) were added to refs/heads/main by this push:
     new efe377e90 IDP-2069 - Null Handling Task
efe377e90 is described below

commit efe377e90a744e05888b589959be766b61855e91
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Mar 31 12:13:45 2023 -0400

    IDP-2069 - Null Handling Task
    
    https://shibboleth.atlassian.net/browse/IDP-2069
    
    Cleaned rest of opensaml-xmlsec-impl code, tests partly worked on.
    Adjusted more support APIs to disallow nulls.
    Altered security resolvers to allow for null CriteriaSets.
---
 ...MLMetadataEncryptionParametersResolverTest.java |   4 +-
 ...dataSignatureSigningParametersResolverTest.java |   4 +-
 .../security/credential/CredentialSupport.java     |  21 +-
 .../xmlsec/encryption/support/Encrypter.java       |  18 +-
 .../xmlsec/keyinfo/KeyInfoGeneratorManager.java    |   6 +-
 .../opensaml/xmlsec/keyinfo/KeyInfoSupport.java    |   4 +-
 .../keyinfo/NamedKeyInfoGeneratorManager.java      |  16 +-
 .../AbstractDerivationKeyAgreementProcessor.java   |   6 +-
 .../impl/AbstractKeyAgreementProcessor.java        |  18 +-
 .../DHWithExplicitKDFKeyAgreementProcessor.java    |  13 +-
 .../impl/DHWithLegacyKDFKeyAgreementProcessor.java |  31 ++-
 .../agreement/impl/ECDHKeyAgreementProcessor.java  |  14 +-
 .../opensaml/xmlsec/agreement/impl/KANonce.java    |   2 +-
 .../impl/KeyAgreementParametersParser.java         |   8 +-
 .../xmlsec/agreement/impl/PrivateCredential.java   |   4 +-
 .../DefaultSecurityConfigurationBootstrap.java     |  16 +-
 .../config/impl/XMLObjectProviderInitializer.java  |   6 +-
 .../opensaml/xmlsec/derivation/impl/ConcatKDF.java |  13 +-
 .../xmlsec/derivation/impl/DHLegacyKDF.java        |  22 +-
 .../opensaml/xmlsec/derivation/impl/PBKDF2.java    |  65 +++---
 .../impl/AbstractSecurityParametersResolver.java   |   8 +-
 .../impl/BasicAlgorithmPolicyConfiguration.java    |  23 +--
 .../impl/BasicDecryptionParametersResolver.java    |  45 ++--
 .../xmlsec/impl/BasicEncryptionConfiguration.java  |  40 ++--
 .../impl/BasicEncryptionParametersResolver.java    | 230 ++++++++++++---------
 .../impl/BasicSignatureSigningConfiguration.java   |  26 +--
 .../BasicSignatureSigningParametersResolver.java   | 145 +++++++------
 ...BasicSignatureValidationParametersResolver.java |  40 ++--
 .../xmlsec/impl/ExcludedAlgorithmsPredicate.java   |   4 +-
 .../xmlsec/impl/IncludedAlgorithmsPredicate.java   |   4 +-
 .../impl/StaticDecryptionParametersResolver.java   |  17 +-
 .../impl/StaticEncryptionParametersResolver.java   |  17 +-
 .../StaticSignatureSigningParametersResolver.java  |  16 +-
 ...taticSignatureValidationParametersResolver.java |  15 +-
 .../keyinfo/impl/BasicKeyInfoGeneratorFactory.java |  13 +-
 .../BasicProviderKeyInfoCredentialResolver.java    |  21 +-
 .../impl/KeyAgreementKeyInfoGeneratorFactory.java  |  45 ++--
 .../keyinfo/impl/KeyInfoCredentialContext.java     |   3 +-
 .../keyinfo/impl/KeyInfoResolutionContext.java     |  15 +-
 .../impl/LocalKeyInfoCredentialResolver.java       |  42 ++--
 .../keyinfo/impl/StaticKeyInfoGenerator.java       |  17 +-
 .../keyinfo/impl/X509KeyInfoGeneratorFactory.java  |  33 ++-
 .../impl/provider/AbstractKeyInfoProvider.java     |   6 +-
 .../provider/AgreementMethodKeyInfoProvider.java   |  44 ++--
 .../impl/provider/DEREncodedKeyValueProvider.java  |   7 +-
 .../impl/provider/InlineX509DataProvider.java      |  47 +++--
 .../impl/provider/KeyInfoReferenceProvider.java    |  23 ++-
 .../keyinfo/impl/provider/RSAKeyValueProvider.java |   4 +-
 ...pulateSignatureValidationParametersHandler.java |   2 +-
 .../support/impl/BaseSignatureTrustEngine.java     |  19 +-
 .../impl/ChainingSignaturePrevalidator.java        |  10 +-
 .../support/impl/ChainingSignatureTrustEngine.java |  18 +-
 .../impl/ExplicitKeySignatureTrustEngine.java      |  24 ++-
 .../support/impl/PKIXSignatureTrustEngine.java     |  17 +-
 .../support/impl/SignatureAlgorithmValidator.java  |   8 +-
 .../ApacheSantuarioSignerProviderImpl.java         |  10 +-
 ...DHWithExplicitKDFKeyAgreementProcessorTest.java |  37 ++--
 .../DHWithLegacyKDFKeyAgreementProcessorTest.java  |  47 +++--
 .../xmlsec/agreement/impl/DigestMethodTest.java    |   4 +-
 .../impl/ECDHKeyAgreementProcessorTest.java        |  30 +--
 .../xmlsec/agreement/impl/KANonceTest.java         |  26 ++-
 .../impl/KeyAgreementParametersParserTest.java     | 138 ++++++-------
 .../agreement/impl/PrivateCredentialTest.java      |   4 +-
 .../agreement/tests/KeyAgreementSupportTest.java   |   4 +-
 .../algorithm/tests/AlgorithmDescriptorsTest.java  |   4 +-
 .../algorithm/tests/AlgorithmRegistryTest.java     |   8 +-
 .../algorithm/tests/AlgorithmSupportTest.java      |   1 +
 .../DefaultSecurityConfigurationBootstrapTest.java |  16 +-
 .../GlobalKeyAgreementProcessorRegistryTest.java   |   8 +-
 .../testing/TestXMLObjectProviderInitializer.java  |   6 +-
 .../xmlsec/crypto/tests/XMLSigningUtilTest.java    |   1 +
 .../xmlsec/derivation/impl/ConcatKDFTest.java      |   9 +-
 .../xmlsec/derivation/impl/DHLegacyKDFTest.java    |  10 +-
 .../xmlsec/derivation/impl/MockKeyDerivation.java  |  15 +-
 .../xmlsec/derivation/impl/PBKDF2Test.java         | 157 +++++++-------
 .../derivation/tests/KeyDerivationSupportTest.java |   4 +-
 .../encryption/support/tests/AESGCMTest.java       |  34 +--
 .../tests/ChainingEncryptedKeyResolverTest.java    |  57 +++--
 .../support/tests/DHWithExplicitKDFTest.java       |   4 +-
 .../support/tests/DHWithLegacyKDFTest.java         |   4 +-
 .../support/tests/DecryptionSignedContentTest.java |  42 ++--
 .../tests/DefaultPreDecryptionValidatorTest.java   |  14 +-
 .../xmlsec/encryption/support/tests/ECDHTest.java  |   6 +-
 .../support/tests/EncryptionClonedContentTest.java |   4 +-
 .../support/tests/SimpleDecryptionTest.java        |   1 -
 .../BasicDecryptionParametersResolverTest.java     |   6 +-
 .../BasicEncryptionParametersResolverTest.java     |   4 +-
 ...asicSignatureSigningParametersResolverTest.java |   4 +-
 ...cSignatureValidationParametersResolverTest.java |   4 +-
 .../xmlsec/keyinfo/impl/AgreementMethodTest.java   |  93 +++++----
 .../keyinfo/impl/BasicKeyInfoGeneratorTest.java    |  10 +-
 .../impl/NamedKeyInfoGeneratorManagerTest.java     |   3 +
 .../keyinfo/impl/X509KeyInfoGeneratorTest.java     |  34 +--
 .../xmlsec/keyinfo/tests/KeyInfoSupportTest.java   |  62 +-----
 ...teSignatureValidationParametersHandlerTest.java |  29 ++-
 .../xmlsec/mock/SignableSimpleXMLObject.java       |  49 ++---
 .../mock/SignableSimpleXMLObjectBuilder.java       |   8 +-
 .../impl/ChainingSignatureTrustEngineTest.java     |   4 +-
 .../support/impl/PKIXSignatureTrustEngineTest.java |   1 +
 .../support/tests/DetachedSignatureTest.java       |   8 +-
 .../support/tests/EnvelopedSignatureTest.java      |   7 +-
 .../signature/support/tests/HMACSignatureTest.java |  28 +--
 .../tests/SignatureAlgorithmValidatorTest.java     |   2 +
 .../support/tests/SignatureSupportTest.java        |   8 +-
 104 files changed, 1309 insertions(+), 1099 deletions(-)

diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java
index 6aa7cf240..75e3511b0 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java
@@ -1043,9 +1043,9 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
         Assert.assertNull(params);
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
+    @Test
     public void testNullCriteriaSet() throws ResolverException {
-        resolver.resolve(null);
+        Assert.assertNull(resolver.resolveSingle(null));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
index a5d3d6e3f..6fd7f2add 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
@@ -375,9 +375,9 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
         Assert.assertNull(params);
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
+    @Test
     public void testNullCriteriaSet() throws ResolverException {
-        resolver.resolve(null);
+        Assert.assertNull(resolver.resolveSingle(null));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/credential/CredentialSupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/credential/CredentialSupport.java
index eed56e775..6cdec2ce2 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/credential/CredentialSupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/credential/CredentialSupport.java
@@ -33,7 +33,6 @@ import org.opensaml.security.x509.BasicX509Credential;
  */
 public final class CredentialSupport {
     
-    
     /** Constructor. */
     private CredentialSupport() { }
 
@@ -43,10 +42,7 @@ public final class CredentialSupport {
      * @param credential the credential containing the encryption key
      * @return the encryption key (either a public key or a secret (symmetric) key
      */
-    @Nullable public static Key extractEncryptionKey(@Nullable final Credential credential) {
-        if (credential == null) {
-            return null;
-        }
+    @Nullable public static Key extractEncryptionKey(@Nonnull final Credential credential) {
         if (credential.getPublicKey() != null) {
             return credential.getPublicKey();
         }
@@ -59,10 +55,7 @@ public final class CredentialSupport {
      * @param credential the credential containing the decryption key
      * @return the decryption key (either a private key or a secret (symmetric) key
      */
-    @Nullable public static Key extractDecryptionKey(@Nullable final Credential credential) {
-        if (credential == null) {
-            return null;
-        }
+    @Nullable public static Key extractDecryptionKey(@Nonnull final Credential credential) {
         if (credential.getPrivateKey() != null) {
             return credential.getPrivateKey();
         }
@@ -75,10 +68,7 @@ public final class CredentialSupport {
      * @param credential the credential containing the signing key
      * @return the signing key (either a private key or a secret (symmetric) key
      */
-    @Nullable public static Key extractSigningKey(@Nullable final Credential credential) {
-        if (credential == null) {
-            return null;
-        }
+    @Nullable public static Key extractSigningKey(@Nonnull final Credential credential) {
         if (credential.getPrivateKey() != null) {
             return credential.getPrivateKey();
         }
@@ -91,10 +81,7 @@ public final class CredentialSupport {
      * @param credential the credential containing the verification key
      * @return the verification key (either a public key or a secret (symmetric) key
      */
-    @Nullable public static Key extractVerificationKey(@Nullable final Credential credential) {
-        if (credential == null) {
-            return null;
-        }
+    @Nullable public static Key extractVerificationKey(@Nonnull final Credential credential) {
         if (credential.getPublicKey() != null) {
             return credential.getPublicKey();
         }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java
index 3bc649ba8..faed54353 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java
@@ -46,6 +46,7 @@ import org.opensaml.core.xml.io.Unmarshaller;
 import org.opensaml.core.xml.io.UnmarshallerFactory;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.security.SecurityException;
+import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.opensaml.xmlsec.encryption.EncryptedData;
@@ -298,7 +299,9 @@ public class Encrypter {
 
         checkParams(kekParams, false);
 
-        final Key encryptionKey = CredentialSupport.extractEncryptionKey(kekParams.getEncryptionCredential());
+        final Credential encryptionCred = kekParams.getEncryptionCredential();
+        final Key encryptionKey = encryptionCred != null
+                ? CredentialSupport.extractEncryptionKey(encryptionCred) : null;
         if (encryptionKey == null) {
             throw new EncryptionException("Unable to obtain encryption key from parameters");
         }
@@ -571,8 +574,11 @@ public class Encrypter {
         checkParams(encParams, kekParamsList);
 
         final String encryptionAlgorithmURI = encParams.getAlgorithm();
+        // Checked above.
         assert encryptionAlgorithmURI != null;
-        Key encryptionKey = CredentialSupport.extractEncryptionKey(encParams.getEncryptionCredential());
+        
+        final Credential encryptionCred = encParams.getEncryptionCredential();
+        Key encryptionKey = encryptionCred != null ? CredentialSupport.extractEncryptionKey(encryptionCred) : null;
         if (encryptionKey == null) {
             encryptionKey = generateEncryptionKey(encryptionAlgorithmURI);
         }
@@ -664,7 +670,9 @@ public class Encrypter {
             log.error("Key encryption parameters are required");
             throw new EncryptionException("Key encryption parameters are required");
         }
-        final Key key = CredentialSupport.extractEncryptionKey(kekParams.getEncryptionCredential());
+        
+        final Credential encryptionCred = kekParams.getEncryptionCredential();
+        final Key key = encryptionCred != null ? CredentialSupport.extractEncryptionKey(encryptionCred) : null;
         if (key == null) {
             log.error("Key encryption credential and contained key are required");
             throw new EncryptionException("Key encryption credential and contained key are required");
@@ -715,7 +723,9 @@ public class Encrypter {
         checkParams(encParams);
         checkParams(kekParamsList, true);
 
-        if (CredentialSupport.extractEncryptionKey(encParams.getEncryptionCredential()) == null
+        final Credential encryptionCred = encParams.getEncryptionCredential();
+        
+        if ((encryptionCred == null || CredentialSupport.extractEncryptionKey(encryptionCred) == null)
                 && (kekParamsList == null || kekParamsList.isEmpty())) {
             log.error("Using a generated encryption key requires a KeyEncryptionParameters "
                     + "object and key encryption key");
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java
index 9c0241f8b..1452b1061 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoGeneratorManager.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.keyinfo;
 
 import java.util.Collection;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -27,6 +26,7 @@ import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -36,7 +36,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class KeyInfoGeneratorManager {
     
     /** The factories being managed, indexed by credential type. */
-    private final Map<Class<? extends Credential>, KeyInfoGeneratorFactory> factories;
+    @Nonnull private final Map<Class<? extends Credential>, KeyInfoGeneratorFactory> factories;
     
     /** Constructor. */
     public KeyInfoGeneratorManager() {
@@ -68,7 +68,7 @@ public class KeyInfoGeneratorManager {
      * @return the collection of managed factories
      */
     @Nonnull public Collection<KeyInfoGeneratorFactory> getFactories() {
-        return Collections.unmodifiableCollection(factories.values());
+        return CollectionSupport.copyToList(factories.values());
     }
     
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
index 5570a4d62..29c33bbf9 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
@@ -544,7 +544,7 @@ public class KeyInfoSupport {
      * @param pk the native Java {@link PublicKey} to add
      * @throws EncodingException if base64 encoding the components of the public key <code>pk</code> fails
      */
-    public static void addPublicKey(@Nonnull final KeyInfo keyInfo, @Nullable final PublicKey pk) 
+    public static void addPublicKey(@Nonnull final KeyInfo keyInfo, @Nonnull final PublicKey pk) 
             throws EncodingException {
         Constraint.isNotNull(keyInfo, "KeyInfo cannot be null");
         
@@ -561,7 +561,7 @@ public class KeyInfoSupport {
         } else if (pk instanceof DHPublicKey) {
             keyValue.setDHKeyValue(buildDHKeyValue((DHPublicKey) pk));
         } else {
-            final String type = pk != null ? pk.getClass().getName() : "(null)";
+            final String type = pk.getClass().getName();
             throw new IllegalArgumentException("Saw unsupported public key type: " + type);
         }
 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java
index d3f2ff58e..c7495e5df 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/NamedKeyInfoGeneratorManager.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.xmlsec.keyinfo;
 
-import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
 
@@ -26,9 +25,12 @@ import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyMap;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A manager for named sets of {@link KeyInfoGeneratorFactory} instances. Each name key serves as an index to an
@@ -37,13 +39,13 @@ import net.shibboleth.shared.collection.LazyMap;
 public class NamedKeyInfoGeneratorManager {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(NamedKeyInfoGeneratorManager.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(NamedKeyInfoGeneratorManager.class);
     
     /** The set of named factory managers. */
-    private final Map<String, KeyInfoGeneratorManager> managers;
+    @Nonnull private final Map<String, KeyInfoGeneratorManager> managers;
     
     /** The default manager for unnamed factories. */
-    private final KeyInfoGeneratorManager defaultManager;
+    @Nonnull private final KeyInfoGeneratorManager defaultManager;
     
     /** Flag indicating whether the default (unnamed) factory manager will be used to 
      * lookup factories for credentials. */
@@ -71,8 +73,8 @@ public class NamedKeyInfoGeneratorManager {
      * 
      * @return the set of all manager names currently configured
      */
-    @Nonnull public Set<String> getManagerNames() {
-        return Collections.unmodifiableSet(managers.keySet());
+    @Nonnull @Unmodifiable @NotLive public Set<String> getManagerNames() {
+        return CollectionSupport.copyToSet(managers.keySet());
     }
  
     /**
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java
index 94bfcfde4..2dbf3fab9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.xmlsec.agreement.impl;
 
-
 import javax.annotation.Nonnull;
 import javax.crypto.SecretKey;
 
@@ -35,7 +34,7 @@ import org.opensaml.xmlsec.derivation.KeyDerivationException;
 public abstract class AbstractDerivationKeyAgreementProcessor extends AbstractKeyAgreementProcessor {
 
     /** {@inheritDoc} */
-    protected SecretKey deriveSecretKey(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
+    @Nonnull protected SecretKey deriveSecretKey(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
         final KeyDerivation keyDerivation = parameters.stream()
@@ -47,7 +46,8 @@ public abstract class AbstractDerivationKeyAgreementProcessor extends AbstractKe
             throw new KeyAgreementException("Required KeyDerivation parameter was not supplied");
         }
         
-        final Integer keySize = parameters.contains(KeySize.class) ? parameters.get(KeySize.class).getSize() : null;
+        final KeySize keySizeParam = parameters.get(KeySize.class);
+        final Integer keySize = keySizeParam != null ? keySizeParam.getSize() : null;
         
         KeyAgreementSupport.validateKeyAlgorithmAndSize(keyAlgorithm, keySize);
         
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java
index e78b7133e..1da55b3a3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java
@@ -18,6 +18,7 @@
 package org.opensaml.xmlsec.agreement.impl;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
 import org.opensaml.security.credential.Credential;
@@ -26,7 +27,8 @@ import org.opensaml.xmlsec.agreement.KeyAgreementException;
 import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
 import org.opensaml.xmlsec.agreement.KeyAgreementProcessor;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Abstract base class for {@link KeyAgreementProcessor} implementations.
@@ -34,7 +36,7 @@ import org.slf4j.LoggerFactory;
 public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProcessor {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(AbstractKeyAgreementProcessor.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractKeyAgreementProcessor.class);
 
     /** {@inheritDoc} */
     @Nonnull public KeyAgreementCredential execute(@Nonnull final Credential publicCredential,
@@ -45,6 +47,9 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
         final KeyAgreementParameters parameters = new KeyAgreementParameters(inputParameters);
         
         final Credential privateCredential = obtainPrivateCredential(publicCredential, parameters);
+        if (privateCredential == null) {
+            throw new KeyAgreementException("Unable to obtain or derive private key");
+        }
         
         final byte[] secret = generateAgreementSecret(publicCredential, privateCredential, parameters);
         
@@ -63,12 +68,13 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
      * 
      * @throws KeyAgreementException if private credential can not be obtained
      */
-    @Nonnull protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
+    @Nullable protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
-        if (parameters.contains(PrivateCredential.class)) {
+        final PrivateCredential priv = parameters.get(PrivateCredential.class);
+        if (priv != null) {
             log.debug("Found supplied PrivateCredential in KeyAgreementParameters");
-            return parameters.get(PrivateCredential.class).getCredential();
+            return priv.getCredential();
         }
         return null;
         
@@ -141,4 +147,4 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
         return cred;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessor.java
index 493b86016..3f56d7a0a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessor.java
@@ -24,6 +24,7 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.crypto.interfaces.DHPrivateKey;
 import javax.crypto.interfaces.DHPublicKey;
 
@@ -35,7 +36,8 @@ import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
 import org.opensaml.xmlsec.agreement.KeyAgreementProcessor;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Implementation of {@link KeyAgreementProcessor} which performs Diffie-Hellman
@@ -44,15 +46,15 @@ import org.slf4j.LoggerFactory;
 public class DHWithExplicitKDFKeyAgreementProcessor extends AbstractDerivationKeyAgreementProcessor {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(DHWithExplicitKDFKeyAgreementProcessor.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(DHWithExplicitKDFKeyAgreementProcessor.class);
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nonnull public String getAlgorithm() {
         return EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF;
     }
 
     /** {@inheritDoc} */
-    protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
+    @Nullable protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
         final Credential suppliedCredential = super.obtainPrivateCredential(publicCredential, parameters);
@@ -62,7 +64,6 @@ public class DHWithExplicitKDFKeyAgreementProcessor extends AbstractDerivationKe
         
         log.debug("Found no supplied PrivateCredential in KeyAgreementParameters, generating ephemeral key pair");
         
-        
         if (!DHPublicKey.class.isInstance(publicCredential.getPublicKey())) {
             throw new KeyAgreementException("Public credential's public key is not an instance of DHPublicKey");
         }
@@ -78,7 +79,7 @@ public class DHWithExplicitKDFKeyAgreementProcessor extends AbstractDerivationKe
     }
 
     /** {@inheritDoc} */
-    protected byte[] generateAgreementSecret(@Nonnull final Credential publicCredential,
+    @Nonnull protected byte[] generateAgreementSecret(@Nonnull final Credential publicCredential,
             @Nonnull final Credential privateCredential, @Nonnull final KeyAgreementParameters parameters)
                     throws KeyAgreementException {
         
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java
index 3bc8fc031..cf79d6a9f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessor.java
@@ -24,6 +24,7 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 import javax.crypto.interfaces.DHPrivateKey;
 import javax.crypto.interfaces.DHPublicKey;
@@ -39,9 +40,9 @@ import org.opensaml.xmlsec.derivation.KeyDerivationException;
 import org.opensaml.xmlsec.derivation.impl.DHLegacyKDF;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Implementation of {@link KeyAgreementProcessor} which performs Diffie-Hellman
@@ -53,15 +54,15 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
     @Nonnull @NotEmpty public static final String DEFAULT_DIGEST_METHOD = EncryptionConstants.ALGO_ID_DIGEST_SHA256;
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(DHWithLegacyKDFKeyAgreementProcessor.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(DHWithLegacyKDFKeyAgreementProcessor.class);
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nonnull public String getAlgorithm() {
         return EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH;
     }
 
     /** {@inheritDoc} */
-    protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
+    @Nullable protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
         final Credential suppliedCredential = super.obtainPrivateCredential(publicCredential, parameters);
@@ -71,7 +72,6 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
         
         log.debug("Found no supplied PrivateCredential in KeyAgreementParameters, generating ephemeral key pair");
         
-        
         if (!DHPublicKey.class.isInstance(publicCredential.getPublicKey())) {
             throw new KeyAgreementException("Public credential's public key is not an instance of DHPublicKey");
         }
@@ -87,7 +87,7 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
     }
 
     /** {@inheritDoc} */
-    protected byte[] generateAgreementSecret(@Nonnull final Credential publicCredential,
+    @Nonnull protected byte[] generateAgreementSecret(@Nonnull final Credential publicCredential,
             @Nonnull final Credential privateCredential, @Nonnull final KeyAgreementParameters parameters)
                     throws KeyAgreementException {
         
@@ -109,16 +109,18 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
     }
 
     /** {@inheritDoc} */
-    protected SecretKey deriveSecretKey(final byte[] secret, @Nonnull final String keyAlgorithm,
+    @Nonnull protected SecretKey deriveSecretKey(final byte[] secret, @Nonnull final String keyAlgorithm,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
-        final Integer keySize = parameters.contains(KeySize.class) ? parameters.get(KeySize.class).getSize() : null;
+        final KeySize keySizeParam = parameters.get(KeySize.class);
+        final Integer keySize = keySizeParam != null ? keySizeParam.getSize() : null;
         
         KeyAgreementSupport.validateKeyAlgorithmAndSize(keyAlgorithm, keySize);
         
+        final DigestMethod digestMethodParam = parameters.get(DigestMethod.class);
         String digestMethod = null;
-        if (parameters.contains(DigestMethod.class)) {
-            digestMethod = parameters.get(DigestMethod.class).getAlgorithm();
+        if (digestMethodParam != null) {
+            digestMethod = digestMethodParam.getAlgorithm();
         } else {
             digestMethod = DEFAULT_DIGEST_METHOD;
             // Need to add this to params so can be expressed on credential and in XML
@@ -128,14 +130,11 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
         }
         
         // Nonce is optional
-        String nonce = null;
-        if (parameters.contains(KANonce.class)) {
-            nonce = parameters.get(KANonce.class).getValue();
-        }
+        final KANonce nonceParam = parameters.get(KANonce.class);
         
         final DHLegacyKDF kdf = new DHLegacyKDF();
         kdf.setDigestMethod(digestMethod);
-        kdf.setNonce(nonce);
+        kdf.setNonce(nonceParam != null ? nonceParam.getValue() : null);
         
         try {
             return kdf.derive(secret, keyAlgorithm, keySize);
@@ -145,4 +144,4 @@ public class DHWithLegacyKDFKeyAgreementProcessor extends AbstractKeyAgreementPr
         
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessor.java
index 12e5478d8..709cf86da 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessor.java
@@ -26,6 +26,7 @@ import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.credential.Credential;
@@ -35,7 +36,8 @@ import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
 import org.opensaml.xmlsec.agreement.KeyAgreementProcessor;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Implementation of {@link KeyAgreementProcessor} which performs Elliptic Curve Diffie-Hellman (ECDH)
@@ -44,15 +46,15 @@ import org.slf4j.LoggerFactory;
 public class ECDHKeyAgreementProcessor extends AbstractDerivationKeyAgreementProcessor {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(ECDHKeyAgreementProcessor.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ECDHKeyAgreementProcessor.class);
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nonnull public String getAlgorithm() {
         return EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES;
     }
 
     /** {@inheritDoc} */
-    protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
+    @Nullable protected Credential obtainPrivateCredential(@Nonnull final Credential publicCredential,
             @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
         
         final Credential suppliedCredential = super.obtainPrivateCredential(publicCredential, parameters);
@@ -78,7 +80,7 @@ public class ECDHKeyAgreementProcessor extends AbstractDerivationKeyAgreementPro
     }
 
     /** {@inheritDoc} */
-    protected byte[] generateAgreementSecret(@Nonnull final Credential publicCredential,
+    @Nonnull protected byte[] generateAgreementSecret(@Nonnull final Credential publicCredential,
             @Nonnull final Credential privateCredential, @Nonnull final KeyAgreementParameters parameters)
                     throws KeyAgreementException {
         
@@ -99,4 +101,4 @@ public class ECDHKeyAgreementProcessor extends AbstractDerivationKeyAgreementPro
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java
index 4e6827b8b..5e2aa8493 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KANonce.java
@@ -46,7 +46,7 @@ public class KANonce extends AbstractInitializableComponent
     implements XMLExpressableKeyAgreementParameter, CloneableKeyAgreementParameter {
     
     /** Default length for generated salt, in bytes. */
-    public static final Integer DEFAULT_GENERATED_LENGTH = 8;
+    @Nonnull public static final Integer DEFAULT_GENERATED_LENGTH = 8;
     
     /** Base64-encoded nonce value. */
     @Nullable private String value;
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java
index c35c0fdc7..2f818126b 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParser.java
@@ -28,11 +28,11 @@ import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
 import org.opensaml.xmlsec.agreement.KeyAgreementSupport;
 import org.opensaml.xmlsec.encryption.AgreementMethod;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.Lists;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A component which parses an instance of {@link AgreementMethod} and produces a new instance
@@ -41,7 +41,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class KeyAgreementParametersParser {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(KeyAgreementParametersParser.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(KeyAgreementParametersParser.class);
 
     /**
      * Parse the specified {@link AgreementMethod} into an instance of {@link KeyAgreementParameters}.
@@ -68,6 +68,7 @@ public class KeyAgreementParametersParser {
         }
         
         for (final XMLObject xmlChild : xmlChildren) {
+            assert xmlChild != null;
             boolean handled = false;
             for (final KeyAgreementParameterParser parser : parsers) {
                 if (parser.handles(xmlChild)) {
@@ -108,4 +109,5 @@ public class KeyAgreementParametersParser {
         final ServiceLoader<KeyAgreementParameterParser> loader = ServiceLoader.load(KeyAgreementParameterParser.class);
         return Lists.newArrayList(loader);
     }
-}
+
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/PrivateCredential.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/PrivateCredential.java
index 4af80d251..0f73e7da2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/PrivateCredential.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/PrivateCredential.java
@@ -36,7 +36,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class PrivateCredential implements KeyAgreementParameter {
     
     /** The wrapped Credential. */
-    private Credential credential;
+    @Nonnull private Credential credential;
 
     /**
      * Constructor.
@@ -57,4 +57,4 @@ public class PrivateCredential implements KeyAgreementParameter {
         return credential;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
index 167a0488d..ad638523a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
@@ -60,11 +60,11 @@ import org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A utility class which programmatically builds basic instances of various components 
@@ -83,7 +83,7 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull @NotEmpty public static final String PBKDF2 = "PBKDF2";
     
     /** Logger. */
-    private static final Logger LOG = LoggerFactory.getLogger(DefaultSecurityConfigurationBootstrap.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(DefaultSecurityConfigurationBootstrap.class);
     
     /** Constructor. */
     protected DefaultSecurityConfigurationBootstrap() {}
@@ -285,7 +285,7 @@ public class DefaultSecurityConfigurationBootstrap {
      * 
      * @return an EncryptedKey resolver instance
      */
-    protected static EncryptedKeyResolver buildBasicEncryptedKeyResolver() {
+    @Nonnull protected static EncryptedKeyResolver buildBasicEncryptedKeyResolver() {
         final List<EncryptedKeyResolver> resolverChain = new ArrayList<>();
         resolverChain.add(new InlineEncryptedKeyResolver()); 
         resolverChain.add(new SimpleRetrievalMethodEncryptedKeyResolver());
@@ -299,7 +299,7 @@ public class DefaultSecurityConfigurationBootstrap {
      * 
      * @return a KeyInfo credential resolver instance
      */
-    public static KeyInfoCredentialResolver buildBasicInlineKeyInfoCredentialResolver() {
+    @Nonnull public static KeyInfoCredentialResolver buildBasicInlineKeyInfoCredentialResolver() {
         // Basic resolver for inline info
         final ArrayList<KeyInfoProvider> providers = new ArrayList<>();
         providers.add( new RSAKeyValueProvider() );
@@ -318,7 +318,7 @@ public class DefaultSecurityConfigurationBootstrap {
      * 
      * @return a named KeyInfo generator manager instance
      */
-    protected static NamedKeyInfoGeneratorManager buildDataEncryptionKeyInfoGeneratorManager() {
+    @Nonnull protected static NamedKeyInfoGeneratorManager buildDataEncryptionKeyInfoGeneratorManager() {
         // Generator for KeyAgreementCredentials. This factory already defaults the usually desired settings.
         final KeyAgreementKeyInfoGeneratorFactory keyAgreementFactory = new KeyAgreementKeyInfoGeneratorFactory();
         
@@ -333,7 +333,7 @@ public class DefaultSecurityConfigurationBootstrap {
      * 
      * @return a named KeyInfo generator manager instance
      */
-    protected static NamedKeyInfoGeneratorManager buildKeyTransportEncryptionKeyInfoGeneratorManager() {
+    @Nonnull protected static NamedKeyInfoGeneratorManager buildKeyTransportEncryptionKeyInfoGeneratorManager() {
         // Generator for KeyAgreementCredentials. This factory already defaults the usually desired settings.
         final KeyAgreementKeyInfoGeneratorFactory keyAgreementFactory = new KeyAgreementKeyInfoGeneratorFactory();
         
@@ -348,7 +348,7 @@ public class DefaultSecurityConfigurationBootstrap {
      * 
      * @return a named KeyInfo generator manager instance
      */
-    protected static NamedKeyInfoGeneratorManager buildSignatureKeyInfoGeneratorManager() {
+    @Nonnull protected static NamedKeyInfoGeneratorManager buildSignatureKeyInfoGeneratorManager() {
         final NamedKeyInfoGeneratorManager namedManager = new NamedKeyInfoGeneratorManager();
         
         namedManager.setUseDefaultManager(true);
@@ -376,7 +376,7 @@ public class DefaultSecurityConfigurationBootstrap {
      * 
      * @return a named KeyInfo generator manager instance
      */
-    public static NamedKeyInfoGeneratorManager buildBasicKeyInfoGeneratorManager() {
+    @Nonnull public static NamedKeyInfoGeneratorManager buildBasicKeyInfoGeneratorManager() {
         final NamedKeyInfoGeneratorManager namedManager = new NamedKeyInfoGeneratorManager();
         
         namedManager.setUseDefaultManager(true);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/XMLObjectProviderInitializer.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/XMLObjectProviderInitializer.java
index b5b404da9..c27c9dc13 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/XMLObjectProviderInitializer.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/XMLObjectProviderInitializer.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.config.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer;
 
 /**
@@ -25,13 +27,13 @@ import org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer;
 public class XMLObjectProviderInitializer extends AbstractXMLObjectProviderInitializer {
     
     /** Config resources. */
-    private static String[] configs = {
+    @Nonnull private static String[] configs = {
         "/signature-config.xml",
         "/encryption-config.xml", 
         };
 
     /** {@inheritDoc} */
-    protected String[] getConfigResources() {
+    @Nonnull protected String[] getConfigResources() {
         return configs;
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
index 75572e64e..c52e3d152 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
@@ -113,7 +113,7 @@ public class ConcatKDF extends AbstractInitializableComponent
     @Nullable private String suppPrivInfo;
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nonnull public String getAlgorithm() {
         return EncryptionConstants.ALGO_ID_KEYDERIVATION_CONCATKDF;
     }
     
@@ -246,7 +246,7 @@ public class ConcatKDF extends AbstractInitializableComponent
         if (digestMethod == null) {
             digestMethod = DEFAULT_DIGEST_METHOD;
         } else {
-            final AlgorithmDescriptor descriptor = AlgorithmSupport.getGlobalAlgorithmRegistry().get(digestMethod);
+            final AlgorithmDescriptor descriptor = AlgorithmSupport.ensureGlobalAlgorithmRegistry().get(digestMethod);
             if (descriptor == null) {
                 throw new ComponentInitializationException("Specified digest algorithm is unknown: " + digestMethod);
             }
@@ -265,7 +265,7 @@ public class ConcatKDF extends AbstractInitializableComponent
     }
 
     /** {@inheritDoc} */
-    public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
+    @Nonnull public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
             @Nullable final Integer keyLength) throws KeyDerivationException {
         Constraint.isNotNull(secret, "Secret byte[] was null");
         Constraint.isNotNull(keyAlgorithm, "Key algorithm was null");
@@ -457,7 +457,7 @@ public class ConcatKDF extends AbstractInitializableComponent
     }
     
     /** {@inheritDoc} */
-    public XMLObject buildXMLObject() {
+    @Nonnull public XMLObject buildXMLObject() {
         checkComponentActive();
         
         final KeyDerivationMethod method =
@@ -511,11 +511,12 @@ public class ConcatKDF extends AbstractInitializableComponent
         
         final ConcatKDF parameter = new ConcatKDF();
         
-        if (xmlParams.getDigestMethod() == null || xmlParams.getDigestMethod().getAlgorithm() == null) {
+        final DigestMethod digest = xmlParams.getDigestMethod();
+        if (digest == null || digest.getAlgorithm() == null) {
             throw new ComponentInitializationException("KeyDerivationMethod did not contain DigestMethod value");
         }
         
-        parameter.setDigestMethod(xmlParams.getDigestMethod().getAlgorithm());
+        parameter.setDigestMethod(digest.getAlgorithm());
         
         try {
             parameter.setAlgorithmID(unpadParam(xmlParams.getAlgorithmID(), "AlgorithmID"));
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java
index 4de751c0e..3b63caf40 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDF.java
@@ -31,7 +31,6 @@ import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.opensaml.xmlsec.derivation.KeyDerivationException;
 import org.opensaml.xmlsec.derivation.KeyDerivationSupport;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Charsets;
 import com.google.common.primitives.Bytes;
@@ -39,6 +38,7 @@ import com.google.common.primitives.Bytes;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 /**
@@ -48,7 +48,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class DHLegacyKDF {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(DHLegacyKDF.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(DHLegacyKDF.class);
     
     /** Digest method. */
     @Nullable private String digestMethod;
@@ -92,11 +92,24 @@ public class DHLegacyKDF {
         nonce = StringSupport.trimOrNull(newNonce);
     }
 
-    /** {@inheritDoc} */
-    public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
+    /**
+     * Derrive secret key from inouts.
+     * 
+     * @param secret underlying secret
+     * @param keyAlgorithm key algorithm
+     * @param keyLength key length
+     * 
+     * @return derived key
+     * 
+     * @throws KeyDerivationException on failure
+     */
+    @Nonnull public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
             @Nullable final Integer keyLength) throws KeyDerivationException {
         Constraint.isNotNull(secret, "Secret byte[] was null");
         Constraint.isNotNull(keyAlgorithm, "Key algorithm was null");
+        if (digestMethod == null) {
+            throw new KeyDerivationException("Digest method not set");
+        }
         
         final String jcaKeyAlgorithm = KeyDerivationSupport.getJCAKeyAlgorithm(keyAlgorithm);
         
@@ -123,6 +136,7 @@ public class DHLegacyKDF {
         
         byte[] derived = new byte[] {};
         
+        assert digestMethod != null;
         final String jcaDigest = AlgorithmSupport.getAlgorithmID(digestMethod);
         if (jcaDigest == null) {
             log.warn("Could not resolve JCA algorithm ID from URI: {}", jcaDigest);
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
index 2255d5394..c02c8ff7f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
@@ -100,7 +100,7 @@ public class PBKDF2 extends AbstractInitializableComponent
     @NonnullAfterInit private String prf;
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nonnull public String getAlgorithm() {
         return EncryptionConstants.ALGO_ID_KEYDERIVATION_PBKDF2;
     }
     
@@ -265,7 +265,7 @@ public class PBKDF2 extends AbstractInitializableComponent
         if (prf == null) {
             prf = DEFAULT_PRF;
         } else {
-            final AlgorithmDescriptor descriptor = AlgorithmSupport.getGlobalAlgorithmRegistry().get(prf);
+            final AlgorithmDescriptor descriptor = AlgorithmSupport.ensureGlobalAlgorithmRegistry().get(prf);
             if (descriptor == null) {
                 throw new ComponentInitializationException("Specified PRF algorithm is unknown: " + prf);
             }
@@ -277,7 +277,7 @@ public class PBKDF2 extends AbstractInitializableComponent
     // Checkstyle: CyclomaticComplexity ON
 
     /** {@inheritDoc} */
-    public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
+    @Nonnull public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
             @Nullable final Integer specifiedKeyLength) throws KeyDerivationException {
         Constraint.isNotNull(secret, "Secret byte[] was null");
         Constraint.isNotNull(keyAlgorithm, "Key algorithm was null");
@@ -323,6 +323,7 @@ public class PBKDF2 extends AbstractInitializableComponent
         } else {
             // Usually the recipient/decrypting case, where value is parsed from the Salt XML Element.
             try {
+                assert salt != null;
                 saltBytes = Base64Support.decode(salt);
             } catch (final DecodingException e) {
                 // We already tested this during init so this shouldn't happen
@@ -353,7 +354,8 @@ public class PBKDF2 extends AbstractInitializableComponent
         } else {
             // Usually the recipient/decrypting case, where value is parsed from the KeyLength XML Element.
             // Validate that specified key length value matches that of the specified algorithm URI.
-            if (! keyLength.equals(jcaKeyLength)) {
+            assert keyLength != null;
+            if (!keyLength.equals(jcaKeyLength)) {
                 throw new KeyDerivationException(String.format("Specified key length '%d' does not match URI: %s",
                         keyLength, keyAlgorithm));
             }
@@ -373,7 +375,7 @@ public class PBKDF2 extends AbstractInitializableComponent
     }
 
     /** {@inheritDoc} */
-    public XMLObject buildXMLObject() {
+    @Nonnull public XMLObject buildXMLObject() {
         checkComponentActive();
         
         // If initialized, iterationCount and PRF are guaranteed to be non-null.
@@ -406,6 +408,7 @@ public class PBKDF2 extends AbstractInitializableComponent
         final KeyLength xmlKeyLength = (KeyLength) XMLObjectSupport.buildXMLObject(KeyLength.DEFAULT_ELEMENT_NAME);
         // Note: We're tracking this in # of bits, but the XML element uses # of bytes.
         // It's already validated to be an exact multiple of 8.
+        assert keyLength != null;
         xmlKeyLength.setValue(keyLength / 8);
         params.setKeyLength(xmlKeyLength);
         
@@ -443,20 +446,8 @@ public class PBKDF2 extends AbstractInitializableComponent
         
         final PBKDF2Params xmlParams =
                 (PBKDF2Params) xmlObject.getUnknownXMLObjects(PBKDF2Params.DEFAULT_ELEMENT_NAME).get(0);
-        
-        validateXMLObjectParameters(xmlParams);
-        
-        final PBKDF2 param = new PBKDF2();
-        
-        param.setIterationCount(xmlParams.getIterationCount().getValue());
-        // Note: We're tracking this in # of bits, but the XML element uses # of bytes.
-        param.setKeyLength(xmlParams.getKeyLength().getValue() * 8);
-        param.setPRF(xmlParams.getPRF().getAlgorithm());
-        param.setSalt(xmlParams.getSalt().getSpecified().getValue());
-        
-        param.initialize();
-        
-        return param;
+        assert xmlParams != null;
+        return validateAndSetXMLObjectParameters(xmlParams);
     }
     
     /**
@@ -464,31 +455,51 @@ public class PBKDF2 extends AbstractInitializableComponent
      * 
      * @param xmlParams the instance to validate
      * 
+     * @return the initialized {@link PBKDF2} object
+     * 
      * @throws ComponentInitializationException if the specified params fails validation of required values
      */
     // Checkstyle: CyclomaticComplexity OFF
-    private static void validateXMLObjectParameters(@Nonnull final PBKDF2Params xmlParams)
+    @Nonnull private static PBKDF2 validateAndSetXMLObjectParameters(@Nonnull final PBKDF2Params xmlParams)
             throws ComponentInitializationException {
         
-        if (xmlParams.getIterationCount() == null || xmlParams.getIterationCount().getValue() == null) {
+        final IterationCount iterCount = xmlParams.getIterationCount();
+        if (iterCount == null || iterCount.getValue() == null) {
             throw new ComponentInitializationException("PBKDF2-params did not contain IterationCount value");
         }
         
-        if (xmlParams.getKeyLength() == null || xmlParams.getKeyLength().getValue() == null) {
+        final KeyLength keyLengthObject = xmlParams.getKeyLength();
+        final Integer keyLength = keyLengthObject != null ? keyLengthObject.getValue() : null;
+        if (keyLength == null) {
             throw new ComponentInitializationException("PBKDF2-params did not contain KeyLength value");
         }
         
-        if (xmlParams.getPRF() == null || xmlParams.getPRF().getAlgorithm() == null) {
+        final PRF prf = xmlParams.getPRF();
+        if (prf == null || prf.getAlgorithm() == null) {
             throw new ComponentInitializationException("PBKDF2-params did not contain PRF value");
         }
-        if (xmlParams.getPRF().getParameters() != null) {
+        
+        if (prf.getParameters() != null) {
             throw new ComponentInitializationException("PBKDF2-params contained unsupported PRF parameters");
         }
         
-        if (xmlParams.getSalt() == null || xmlParams.getSalt().getSpecified() == null
-                || xmlParams.getSalt().getSpecified().getValue() == null) {
+        final Salt salt = xmlParams.getSalt();
+        final Specified specified = salt != null ? salt.getSpecified() : null;
+        if (specified == null || specified.getValue() == null) {
             throw new ComponentInitializationException("PBKDF2-params did not contain Salt Specified value");
         }
+        
+        final PBKDF2 param = new PBKDF2();
+        
+        param.setIterationCount(iterCount.getValue());
+
+        // Note: We're tracking this in # of bits, but the XML element uses # of bytes.
+        param.setKeyLength(keyLength * 8);
+        param.setPRF(prf.getAlgorithm());
+        param.setSalt(specified.getValue());
+        
+        param.initialize();
+        return param;
     }
     // Checkstyle: CyclomaticComplexity ON
     
@@ -521,4 +532,4 @@ public class PBKDF2 extends AbstractInitializableComponent
         
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
index 25ab0343a..83c3bad7d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
@@ -29,6 +29,8 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.Resolver;
 
@@ -41,9 +43,7 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
-import com.google.common.base.Predicates;
 
 /**
  * Abstract base class for security parameters resolvers which supplies commonly used functionality for reuse.
@@ -54,7 +54,7 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
         implements Resolver<ProductType, CriteriaSet>{
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(AbstractSecurityParametersResolver.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(AbstractSecurityParametersResolver.class);
     
     /**
      * Resolve a {@link KeyInfoGenerator} instance based on a {@link NamedKeyInfoGeneratorManager}, 
@@ -160,7 +160,7 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
         
         if (includes.isEmpty() && excludes.isEmpty()) {
             log.trace("Both empty, returning alwaysTrue predicate");
-            return Predicates.alwaysTrue();
+            return PredicateSupport.alwaysTrue();
         }
         
         if (includes.isEmpty()) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
index 874ba163e..047314859 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
@@ -18,8 +18,6 @@
 package org.opensaml.xmlsec.impl;
 
 import java.util.Collection;
-import java.util.Collections;
-import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -29,6 +27,7 @@ import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -43,27 +42,27 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class BasicAlgorithmPolicyConfiguration implements AlgorithmPolicyConfiguration {
     
     /** Default precedence. */
-    public static final Precedence DEFAULT_PRECEDENCE = Precedence.INCLUDE;
+    @Nonnull public static final Precedence DEFAULT_PRECEDENCE = Precedence.INCLUDE;
     
     /** Included algorithm URIs. */
-    private Collection<String> includes;
+    @Nonnull private Collection<String> includes;
     
     /** Include merge flag. */
     private boolean includeMerge;
     
     /** Excluded algorithm URIs. */
-    private Collection<String> excludes;
+    @Nonnull private Collection<String> excludes;
     
     /** Exclude merge flag. */
     private boolean excludeMerge;
     
     /** Precedence flag. */
-    private Precedence precedence;
+    @Nonnull private Precedence precedence;
     
     /** Constructor. */
     public BasicAlgorithmPolicyConfiguration() {
-        includes = Collections.emptySet();
-        excludes = Collections.emptySet();
+        includes = CollectionSupport.emptySet();
+        excludes = CollectionSupport.emptySet();
         precedence = DEFAULT_PRECEDENCE;
         
         // These merging defaults are intended to be the more secure/conservative approach:
@@ -85,10 +84,10 @@ public class BasicAlgorithmPolicyConfiguration implements AlgorithmPolicyConfigu
      */
     public void setIncludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
-            includes = Collections.emptySet();
+            includes = CollectionSupport.emptySet();
             return;
         }
-        includes = Set.copyOf(StringSupport.normalizeStringCollection(uris));
+        includes = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(uris));
     }
 
     /** 
@@ -124,10 +123,10 @@ public class BasicAlgorithmPolicyConfiguration implements AlgorithmPolicyConfigu
      */
     public void setExcludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
-            excludes = Collections.emptySet();
+            excludes = CollectionSupport.emptySet();
             return;
         }
-        excludes = Set.copyOf(StringSupport.normalizeStringCollection(uris));
+        excludes = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(uris));
     }
 
     /** 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java
index 9e15c4533..8cefc23f2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java
@@ -17,12 +17,12 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -33,7 +33,6 @@ import org.opensaml.xmlsec.criterion.DecryptionConfigurationCriterion;
 import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Basic implementation of {@link DecryptionParametersResolver}.
@@ -49,29 +48,33 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
         implements DecryptionParametersResolver {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(BasicDecryptionParametersResolver.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(BasicDecryptionParametersResolver.class);
 
     /** {@inheritDoc} */
-    @Nonnull public Iterable<DecryptionParameters> resolve(@Nonnull final CriteriaSet criteria) 
+    @Nonnull public Iterable<DecryptionParameters> resolve(@Nullable final CriteriaSet criteria) 
             throws ResolverException {
         
         final DecryptionParameters params = resolveSingle(criteria);
         if (params != null) {
-            return Collections.singletonList(params);
+            return CollectionSupport.singletonList(params);
         }
-        return Collections.emptyList();
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
-    @Nullable public DecryptionParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
-        Constraint.isNotNull(criteria, "CriteriaSet was null");
-        Constraint.isNotNull(criteria.get(DecryptionConfigurationCriterion.class), 
+    @Nullable public DecryptionParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
+        if (criteria == null) {
+            log.debug("CriteriaSet was null");
+            return null;
+        }
+
+        final DecryptionConfigurationCriterion criterion = Constraint.isNotNull(
+                criteria.get(DecryptionConfigurationCriterion.class),
                 "Resolver requires an instance of DecryptionConfigurationCriterion");
         
         final DecryptionParameters params = new DecryptionParameters();
         
-        resolveAndPopulateIncludesExcludes(params, criteria, 
-                criteria.get(DecryptionConfigurationCriterion.class).getConfigurations());
+        resolveAndPopulateIncludesExcludes(params, criteria, criterion.getConfigurations());
         
         params.setDataKeyInfoCredentialResolver(resolveDataKeyInfoCredentialResolver(criteria));
         params.setKEKKeyInfoCredentialResolver(resolveKEKKeyInfoCredentialResolver(criteria));
@@ -113,8 +116,10 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
      */
     @Nullable protected EncryptedKeyResolver resolveEncryptedKeyResolver(@Nonnull final CriteriaSet criteria) {
         
-        for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+        final DecryptionConfigurationCriterion criterion = criteria.get(DecryptionConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final DecryptionConfiguration config : criterion.getConfigurations()) {
             if (config.getEncryptedKeyResolver() != null) {
                 return config.getEncryptedKeyResolver();
             }
@@ -132,8 +137,10 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
     @Nullable protected KeyInfoCredentialResolver resolveKEKKeyInfoCredentialResolver(
             @Nonnull final CriteriaSet criteria) {
         
-        for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+        final DecryptionConfigurationCriterion criterion = criteria.get(DecryptionConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final DecryptionConfiguration config : criterion.getConfigurations()) {
             if (config.getKEKKeyInfoCredentialResolver() != null) {
                 return config.getKEKKeyInfoCredentialResolver();
             }
@@ -151,8 +158,10 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
     @Nullable protected KeyInfoCredentialResolver resolveDataKeyInfoCredentialResolver(
             @Nonnull final CriteriaSet criteria) {
         
-        for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+        final DecryptionConfigurationCriterion criterion = criteria.get(DecryptionConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final DecryptionConfiguration config : criterion.getConfigurations()) {
             if (config.getDataKeyInfoCredentialResolver() != null) {
                 return config.getDataKeyInfoCredentialResolver();
             }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
index a01bdd909..dee4cf6a5 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 
@@ -27,6 +26,7 @@ import javax.annotation.Nullable;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.opensaml.security.credential.Credential;
@@ -35,9 +35,6 @@ import org.opensaml.xmlsec.KeyTransportAlgorithmPredicate;
 import org.opensaml.xmlsec.encryption.support.KeyAgreementEncryptionConfiguration;
 import org.opensaml.xmlsec.encryption.support.RSAOAEPParameters;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
 
 /**
  * Basic implementation of {@link EncryptionConfiguration}.
@@ -45,9 +42,6 @@ import org.slf4j.LoggerFactory;
 public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfiguration 
         implements EncryptionConfiguration {
     
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(BasicEncryptionConfiguration.class);
-    
     /** Data encryption credentials. */
     @Nonnull @NonnullElements private List<Credential> dataEncryptionCredentials;
     
@@ -84,11 +78,11 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
     
     /** Constructor. */
     public BasicEncryptionConfiguration() {
-        dataEncryptionCredentials = Collections.emptyList();
-        dataEncryptionAlgorithms = Collections.emptyList();
-        keyTransportEncryptionCredentials = Collections.emptyList();
-        keyTransportEncryptionAlgorithms = Collections.emptyList();
-        keyAgreementConfigurations = Collections.emptyMap();
+        dataEncryptionCredentials = CollectionSupport.emptyList();
+        dataEncryptionAlgorithms = CollectionSupport.emptyList();
+        keyTransportEncryptionCredentials = CollectionSupport.emptyList();
+        keyTransportEncryptionAlgorithms = CollectionSupport.emptyList();
+        keyAgreementConfigurations = CollectionSupport.emptyMap();
         
         rsaOAEPParametersMerge = true;
     }
@@ -106,9 +100,9 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      */
     public void setDataEncryptionCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
         if (credentials == null) {
-            dataEncryptionCredentials  = Collections.emptyList();
+            dataEncryptionCredentials  = CollectionSupport.emptyList();
         } else {
-            dataEncryptionCredentials = List.copyOf(credentials);
+            dataEncryptionCredentials = CollectionSupport.copyToList(credentials);
         }
     }
     
@@ -125,9 +119,10 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      */
     public void setDataEncryptionAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
         if (algorithms == null) {
-            dataEncryptionAlgorithms = Collections.emptyList();
+            dataEncryptionAlgorithms = CollectionSupport.emptyList();
         } else {
-            dataEncryptionAlgorithms = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+            dataEncryptionAlgorithms =
+                    CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
     }
     
@@ -144,9 +139,9 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      */
     public void setKeyTransportEncryptionCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
         if (credentials == null) {
-            keyTransportEncryptionCredentials  = Collections.emptyList();
+            keyTransportEncryptionCredentials  = CollectionSupport.emptyList();
         } else {
-            keyTransportEncryptionCredentials = List.copyOf(credentials);
+            keyTransportEncryptionCredentials = CollectionSupport.copyToList(credentials);
         }
     }
     
@@ -163,9 +158,10 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      */
     public void setKeyTransportEncryptionAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
         if (algorithms == null) {
-            keyTransportEncryptionAlgorithms = Collections.emptyList();
+            keyTransportEncryptionAlgorithms = CollectionSupport.emptyList();
         } else {
-            keyTransportEncryptionAlgorithms = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+            keyTransportEncryptionAlgorithms =
+                    CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
     }
     
@@ -262,9 +258,9 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
      */
     public void setKeyAgreementConfigurations(@Nullable final Map<String,KeyAgreementEncryptionConfiguration> configs) {
         if (configs == null) {
-            keyAgreementConfigurations = Collections.emptyMap();
+            keyAgreementConfigurations = CollectionSupport.emptyMap();
         } else {
-            keyAgreementConfigurations = Map.copyOf(configs);
+            keyAgreementConfigurations = CollectionSupport.copyToMap(configs);
         }
     }
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
index 4766f19ab..ef1235262 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
@@ -20,6 +20,7 @@ package org.opensaml.xmlsec.impl;
 import java.security.Key;
 import java.security.KeyException;
 import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -49,11 +50,12 @@ import org.opensaml.xmlsec.encryption.support.KeyAgreementEncryptionConfiguratio
 import org.opensaml.xmlsec.encryption.support.RSAOAEPParameters;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -76,7 +78,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
     @Nonnull private Logger log = LoggerFactory.getLogger(BasicEncryptionParametersResolver.class);
     
     /** The AlgorithmRegistry used when processing algorithm URIs. */
-    @Nonnull private AlgorithmRegistry algorithmRegistry;
+    @Nullable private AlgorithmRegistry algorithmRegistry;
     
     /** Flag indicating whether the resolver should auto-generate data encryption credentials. */
     private boolean autoGenerateDataEncryptionCredential;
@@ -95,8 +97,9 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
     @Nonnull public AlgorithmRegistry getAlgorithmRegistry() {
         // Handle case where this resolver was ctored before the library was properly initialized.
         if (algorithmRegistry == null) {
-            return AlgorithmSupport.getGlobalAlgorithmRegistry();
+            return AlgorithmSupport.ensureGlobalAlgorithmRegistry();
         }
+        assert algorithmRegistry != null;
         return algorithmRegistry;
     }
 
@@ -130,19 +133,23 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull public Iterable<EncryptionParameters> resolve(@Nonnull final CriteriaSet criteria) 
+    @Nonnull public Iterable<EncryptionParameters> resolve(@Nullable final CriteriaSet criteria) 
             throws ResolverException {
         final EncryptionParameters params = resolveSingle(criteria);
         if (params != null) {
-            return Collections.singletonList(params);
+            return CollectionSupport.singletonList(params);
         }
-        return Collections.emptyList();
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
     @Override
-    @Nullable public EncryptionParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
-        Constraint.isNotNull(criteria, "CriteriaSet was null");
+    @Nullable public EncryptionParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
+        if (criteria == null) {
+            log.debug("CriteriaSet was null");
+            return null;
+        }
+        
         Constraint.isNotNull(criteria.get(EncryptionConfigurationCriterion.class), 
                 "Resolver requires an instance of EncryptionConfigurationCriterion");
         
@@ -184,8 +191,9 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         if (log.isDebugEnabled()) {
             log.debug("Resolved EncryptionParameters:");
             
-            final Key keyTransportKey =
-                    CredentialSupport.extractEncryptionKey(params.getKeyTransportEncryptionCredential());
+            final Credential keyTransportCred = params.getKeyTransportEncryptionCredential();
+            final Key keyTransportKey = keyTransportCred != null
+                    ? CredentialSupport.extractEncryptionKey(keyTransportCred) : null;
             if (keyTransportKey != null) {
                 log.debug("\tKey transport credential with key algorithm: {}", keyTransportKey.getAlgorithm());
             } else {
@@ -194,19 +202,20 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             
             log.debug("\tKey transport algorithm URI: {}", params.getKeyTransportEncryptionAlgorithm()); 
             
-            if (params.getRSAOAEPParameters() != null) {
-                log.debug("\t\tKey transport RSA OAEP digest method URI: {}", 
-                        params.getRSAOAEPParameters().getDigestMethod()); 
-                log.debug("\t\tKey transport RSA OAEP MGF URI: {}", 
-                        params.getRSAOAEPParameters().getMaskGenerationFunction()); 
-                log.debug("\t\tKey transport RSA OAEP OAEPparams: {}", params.getRSAOAEPParameters().getOAEPParams()); 
+            final RSAOAEPParameters oaep = params.getRSAOAEPParameters();
+            if (oaep != null) {
+                log.debug("\t\tKey transport RSA OAEP digest method URI: {}", oaep.getDigestMethod()); 
+                log.debug("\t\tKey transport RSA OAEP MGF URI: {}", oaep.getMaskGenerationFunction()); 
+                log.debug("\t\tKey transport RSA OAEP OAEPparams: {}", oaep.getOAEPParams()); 
             }
             
-            log.debug("\tKey transport KeyInfoGenerator: {}", 
-                    params.getKeyTransportKeyInfoGenerator() != null ?
-                            params.getKeyTransportKeyInfoGenerator().getClass().getName() : "null");
+            KeyInfoGenerator generator = params.getKeyTransportKeyInfoGenerator();
+            log.debug("\tKey transport KeyInfoGenerator: {}",
+                    generator != null ? generator.getClass().getName() : "null");
             
-            final Key dataKey = CredentialSupport.extractEncryptionKey(params.getDataEncryptionCredential());
+            final Credential dataEncryptionCred = params.getDataEncryptionCredential();
+            final Key dataKey = dataEncryptionCred != null
+                    ? CredentialSupport.extractEncryptionKey(dataEncryptionCred) : null;
             if (dataKey != null) {
                 log.debug("\tData encryption credential with key algorithm: {}", dataKey.getAlgorithm());
             } else {
@@ -215,10 +224,9 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             
             log.debug("\tData encryption algorithm URI: {}", params.getDataEncryptionAlgorithm());
             
-            log.debug("\tData encryption KeyInfoGenerator: {}", 
-                    params.getDataKeyInfoGenerator() != null ?
-                            params.getDataKeyInfoGenerator().getClass().getName() : "null");
-            
+            generator = params.getDataKeyInfoGenerator();
+            log.debug("\tData encryption KeyInfoGenerator: {}",
+                    generator != null ? generator.getClass().getName() : "null");
         }
     }
 
@@ -289,24 +297,13 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      * @return a include/exclude predicate instance
      */
     @Nonnull protected Predicate<String> getIncludeExcludePredicate(@Nonnull final CriteriaSet criteria) {
-        return resolveIncludeExcludePredicate(criteria, 
-                criteria.get(EncryptionConfigurationCriterion.class).getConfigurations());
-    }
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
 
-    /**
-     * Get a predicate which implements the effective configured include/exclude policy.
-     * 
-     * @param criteria the input criteria being evaluated
-     * 
-     * @return a include/exclude predicate instance
-     * 
-     * @deprecated
-     */
-    @Deprecated(since="4.1.0",forRemoval=true)
-    @Nonnull protected Predicate<String> getWhitelistBlacklistPredicate(@Nonnull final CriteriaSet criteria) {
-        return getIncludeExcludePredicate(criteria);
+        return resolveIncludeExcludePredicate(criteria, criterion.getConfigurations());
     }
     
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
     /**
      * Resolve and populate the data encryption and key transport credentials and algorithm URIs.
      * 
@@ -335,8 +332,9 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             params.setDataEncryptionAlgorithm(resolveDataEncryptionAlgorithm(null, dataEncryptionAlgorithms));
         } else {
             for (final Credential dataEncryptionCredential : dataEncryptionCredentials) {
+                assert dataEncryptionCredential != null;
                 if (checkAndProcessKeyAgreement(params, criteria, dataEncryptionCredential, dataEncryptionAlgorithms,
-                        Collections.emptyList())) {
+                        CollectionSupport.emptyList())) {
                     return;
                 }
                 
@@ -347,9 +345,11 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
                     params.setDataEncryptionAlgorithm(dataEncryptionAlgorithm);
                     break;
                 }
-                log.debug("Unable to resolve data encryption algorithm for credential with key type '{}', " 
-                        + "considering other credentials", 
-                        CredentialSupport.extractEncryptionKey(dataEncryptionCredential).getAlgorithm());
+                if (log.isDebugEnabled()) {
+                    final Key key = CredentialSupport.extractEncryptionKey(dataEncryptionCredential); 
+                    log.debug("Unable to resolve data encryption algorithm for credential with key type '{}', " 
+                            + "considering other credentials", key != null ? key.getAlgorithm() : null);
+                }
             }
         }
         
@@ -357,6 +357,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         
         // Select key encryption cred and algorithm
         for (final Credential keyTransportCredential : keyTransportCredentials) {
+            assert keyTransportCredential != null;
             if (checkAndProcessKeyAgreement(params, criteria, keyTransportCredential, dataEncryptionAlgorithms,
                     keyTransportAlgorithms)) {
                 return;
@@ -370,9 +371,11 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
                 params.setKeyTransportEncryptionAlgorithm(keyTransportAlgorithm);
                 break;
             }
-            log.debug("Unable to resolve key transport algorithm for credential with key type '{}', " 
-                    + "considering other credentials", 
-                    CredentialSupport.extractEncryptionKey(keyTransportCredential).getAlgorithm());
+            if (log.isDebugEnabled()) {
+                final Key key = CredentialSupport.extractEncryptionKey(keyTransportCredential);
+                log.debug("Unable to resolve key transport algorithm for credential with key type '{}', " 
+                        + "considering other credentials", key != null ? key.getAlgorithm() : null);
+            }
         }
         
         resolveAndPopulateRSAOAEPParams(params, criteria, includeExcludePredicate);
@@ -415,13 +418,15 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             return false; 
         }
         
+        final Key publicKey = credential.getPublicKey();
+        
         log.debug("Processing key agreement for credential with key type: {}",
-                credential.getPublicKey().getAlgorithm());
+                publicKey != null ? publicKey.getAlgorithm() : null);
         
         final KeyAgreementEncryptionConfiguration config = getEffectiveKeyAgreementConfiguration(criteria, credential);
         if (config == null) {
             log.warn("Unable to get effective KeyAgreementEncryptionConfiguration for credential with key type: {}",
-                    credential.getPublicKey().getAlgorithm());
+                    publicKey != null ? publicKey.getAlgorithm() : null);
             return false;
         }
         
@@ -439,7 +444,9 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         
         final String keyAlgorithm = keyTransportAlgorithm != null ? keyTransportAlgorithm : dataEncryptionAlgorithm;
         
-        final KeyAgreementParameters parameters = new KeyAgreementParameters(config.getParameters(), true);
+        final var keyAgreementConfigParams = config.getParameters();
+        assert keyAgreementConfigParams != null;
+        final KeyAgreementParameters parameters = new KeyAgreementParameters(keyAgreementConfigParams, true);
         try {
             parameters.initializeAll();
             parameters.forEach(p -> {
@@ -451,7 +458,9 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         }
         
         try {
-            final KeyAgreementProcessor processor = KeyAgreementSupport.getProcessor(config.getAlgorithm());
+            final String keyAgreementAlg = config.getAlgorithm();
+            assert keyAgreementAlg != null;
+            final KeyAgreementProcessor processor = KeyAgreementSupport.getProcessor(keyAgreementAlg);
         
             final KeyAgreementCredential agreementCredential = processor.execute(credential, keyAlgorithm, parameters);
             
@@ -467,7 +476,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             processDataEncryptionCredentialAutoGeneration(params);
             
             log.debug("Successfully processed key agreement for credential with key type: {}",
-                    credential.getPublicKey().getAlgorithm());
+                    publicKey != null ? publicKey.getAlgorithm() : null);
             
             return true;
         } catch (final KeyAgreementException e) {
@@ -476,6 +485,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         }
         
     }
+// Checkstyle: CyclomaticComplexity|MethodLength ON
     
     /**
      * Get the effective {@link KeyAgreementEncryptionConfiguration} to use with the specified credential.
@@ -486,14 +496,20 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      */
     @Nullable protected KeyAgreementEncryptionConfiguration getEffectiveKeyAgreementConfiguration(
             @Nonnull final CriteriaSet criteria, @Nonnull final Credential credential) {
+
+        final PublicKey publicKey = credential.getPublicKey();
+        final String keyType = publicKey != null ? publicKey.getAlgorithm() : null;
+        if (keyType == null) {
+            log.warn("Unable to extract public key from credential");
+            return null;
+        }
         
-        final String keyType = credential.getPublicKey().getAlgorithm();
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+        final List<EncryptionConfiguration> encConfigs = criterion.getConfigurations();
         
         final KeyAgreementEncryptionConfiguration config = new KeyAgreementEncryptionConfiguration();
         
-        final List<EncryptionConfiguration> encConfigs = criteria.get(EncryptionConfigurationCriterion.class)
-                .getConfigurations();
-        
         config.setAlgorithm(
                 encConfigs.stream()
                     .map(c -> c.getKeyAgreementConfigurations().get(keyType))
@@ -533,15 +549,18 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             @Nonnull final CriteriaSet criteria,
             @Nonnull final Predicate<String> includeExcludePredicate) {
         
-        if (!AlgorithmSupport.isRSAOAEP(params.getKeyTransportEncryptionAlgorithm())) {
+        final String alg = params.getKeyTransportEncryptionAlgorithm();
+        if (alg == null || !AlgorithmSupport.isRSAOAEP(alg)) {
             return;
         }
         
-        if (params.getRSAOAEPParameters() == null) {
-            params.setRSAOAEPParameters(new RSAOAEPParameters());
+        RSAOAEPParameters oaep = params.getRSAOAEPParameters();
+        if (oaep == null) {
+            oaep = new RSAOAEPParameters();
+            params.setRSAOAEPParameters(oaep);
         }
         
-        populateRSAOAEPParams(params.getRSAOAEPParameters(), criteria, includeExcludePredicate);
+        populateRSAOAEPParams(oaep, criteria, includeExcludePredicate);
     }
 
     /**
@@ -555,17 +574,18 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      */
 // Checkstyle: CyclomaticComplexity|ReturnCount OFF -- more readable not split up
     protected void populateRSAOAEPParams(@Nonnull final RSAOAEPParameters rsaParams, 
-            @Nonnull final CriteriaSet criteria,
-            @Nonnull final Predicate<String> includeExcludePredicate) {
+            @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
         
         if (rsaParams.isComplete()) {
             return;
         }
         
         final Predicate<String> algoSupportPredicate = getAlgorithmRuntimeSupportedPredicate();
+
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
         
-        for (final EncryptionConfiguration config :
-                criteria.get(EncryptionConfigurationCriterion.class).getConfigurations()) {
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             
             final RSAOAEPParameters rsaConfig = config.getRSAOAEPParameters();
             if (rsaConfig != null) {
@@ -605,8 +625,11 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      */
     @Nullable protected KeyTransportAlgorithmPredicate resolveKeyTransportAlgorithmPredicate(
             @Nonnull final CriteriaSet criteria) {
-        for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             if (config.getKeyTransportAlgorithmPredicate() != null) {
                 return config.getKeyTransportAlgorithmPredicate();
             }
@@ -636,6 +659,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         }
         
         for (final String algorithm : keyTransportAlgorithms) {
+            assert algorithm != null;
             log.trace("Evaluating key transport credential against algorithm: {}", algorithm);
             if (credentialSupportsAlgorithm(keyTransportCredential, algorithm) && isKeyTransportAlgorithm(algorithm))  {
                 if (keyTransportPredicate != null) {
@@ -683,7 +707,8 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             @Nonnull final List<String> dataEncryptionAlgorithms) {
         
         if (log.isTraceEnabled()) {
-            final Key key = CredentialSupport.extractEncryptionKey(dataEncryptionCredential);
+            final Key key = dataEncryptionCredential != null
+                    ? CredentialSupport.extractEncryptionKey(dataEncryptionCredential) : null;
             log.trace("Evaluating data encryption credential of type: {}", 
                     key != null ? key.getAlgorithm() : "n/a");
         }
@@ -697,6 +722,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
         }
         
         for (final String algorithm : dataEncryptionAlgorithms) {
+            assert algorithm != null;
             log.trace("Evaluating data encryption credential against algorithm: {}", algorithm);
             if (credentialSupportsAlgorithm(dataEncryptionCredential, algorithm) 
                     && isDataEncryptionAlgorithm(algorithm))  {
@@ -732,9 +758,12 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      * @return the list of credentials
      */
     @Nonnull protected List<Credential> getEffectiveDataEncryptionCredentials(@Nonnull final CriteriaSet criteria) {
+
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+
         final ArrayList<Credential> accumulator = new ArrayList<>();
-        for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             
             accumulator.addAll(config.getDataEncryptionCredentials());
             
@@ -754,9 +783,11 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
     @Nonnull protected List<String> getEffectiveDataEncryptionAlgorithms(@Nonnull final CriteriaSet criteria, 
             @Nonnull final Predicate<String> includeExcludePredicate) {
         
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+        
         final ArrayList<String> accumulator = new ArrayList<>();
-        for (final EncryptionConfiguration config
-                : criteria.get(EncryptionConfigurationCriterion.class).getConfigurations()) {
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             
             config.getDataEncryptionAlgorithms()
                 .stream()
@@ -774,13 +805,14 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      * @return the list of credentials
      */
     @Nonnull protected List<Credential> getEffectiveKeyTransportCredentials(@Nonnull final CriteriaSet criteria) {
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+
         final ArrayList<Credential> accumulator = new ArrayList<>();
-        for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
-                .getConfigurations()) {
-            
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             accumulator.addAll(config.getKeyTransportEncryptionCredentials());
-            
         }
+        
         return accumulator;
     }
     
@@ -795,10 +827,12 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      */
     @Nonnull protected List<String> getEffectiveKeyTransportAlgorithms(@Nonnull final CriteriaSet criteria, 
             @Nonnull final Predicate<String> includeExcludePredicate) {
+
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
         
         final ArrayList<String> accumulator = new ArrayList<>();
-        for (final EncryptionConfiguration config
-                : criteria.get(EncryptionConfigurationCriterion.class).getConfigurations()) {
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             
             config.getKeyTransportEncryptionAlgorithms()
                 .stream()
@@ -816,19 +850,20 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      * 
      * @return KeyInfo generator instance, or null
      */
-    @Nullable protected KeyInfoGenerator resolveDataKeyInfoGenerator(@Nullable final CriteriaSet criteria, 
+    @Nullable protected KeyInfoGenerator resolveDataKeyInfoGenerator(@Nonnull final CriteriaSet criteria, 
             @Nullable final Credential dataEncryptionCredential) {
         if (dataEncryptionCredential == null) {
             return null;
         }
+
+        final var keyInfoGenerationProfileCriterion = criteria.get(KeyInfoGenerationProfileCriterion.class);
+        final String name = keyInfoGenerationProfileCriterion != null
+                ? keyInfoGenerationProfileCriterion.getName() : null;
         
-        String name = null;
-        if (criteria.get(KeyInfoGenerationProfileCriterion.class) != null) {
-            name = criteria.get(KeyInfoGenerationProfileCriterion.class).getName();
-        }
-        
-        for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             
             final KeyInfoGenerator kig = lookupKeyInfoGenerator(dataEncryptionCredential, 
                     config.getDataKeyInfoGeneratorManager(), name);
@@ -855,13 +890,14 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
             return null;
         }
         
-        String name = null;
-        if (criteria.get(KeyInfoGenerationProfileCriterion.class) != null) {
-            name = criteria.get(KeyInfoGenerationProfileCriterion.class).getName();
-        }
+        final var keyInfoGenerationProfileCriterion = criteria.get(KeyInfoGenerationProfileCriterion.class);
+        final String name = keyInfoGenerationProfileCriterion != null
+                ? keyInfoGenerationProfileCriterion.getName() : null;
         
-        for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
-                .getConfigurations()) {
+        final EncryptionConfigurationCriterion criterion = criteria.get(EncryptionConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final EncryptionConfiguration config : criterion.getConfigurations()) {
             
             final KeyInfoGenerator kig = lookupKeyInfoGenerator(keyTransportEncryptionCredential, 
                     config.getKeyTransportKeyInfoGeneratorManager(), name);
@@ -946,17 +982,17 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      * @param params the encryption parameters instance to process
      */
     protected void processDataEncryptionCredentialAutoGeneration(@Nonnull final EncryptionParameters params) {
+        final String dataEncryptionAlg = params.getDataEncryptionAlgorithm();
+
         if (isAutoGenerateDataEncryptionCredential() 
                 && params.getKeyTransportEncryptionCredential() != null 
                 && params.getDataEncryptionCredential() == null
-                && params.getDataEncryptionAlgorithm() != null) {
+                && dataEncryptionAlg != null) {
             
-            log.debug("Auto-generating data encryption credential using algorithm URI: {}", 
-                    params.getDataEncryptionAlgorithm());
+            log.debug("Auto-generating data encryption credential using algorithm URI: {}", dataEncryptionAlg);
             
-            params.setDataEncryptionCredential(
-                    generateDataEncryptionCredential(params.getDataEncryptionAlgorithm()));
-        } 
+            params.setDataEncryptionCredential(generateDataEncryptionCredential(dataEncryptionAlg));
+        }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
index 9ab388c84..fb72eb9a6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -26,13 +25,12 @@ import javax.annotation.Nullable;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.SignatureSigningConfiguration;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Basic implementation of {@link SignatureSigningConfiguration}.
@@ -40,9 +38,6 @@ import org.slf4j.LoggerFactory;
 public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConfiguration 
         implements SignatureSigningConfiguration {
     
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(BasicSignatureSigningConfiguration.class);
-    
     /** Signing credentials. */
     @Nonnull @NonnullElements private List<Credential> signingCredentials;
     
@@ -70,9 +65,9 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
     
     /** Constructor. */
     public BasicSignatureSigningConfiguration() {
-        signingCredentials = Collections.emptyList();
-        signatureAlgorithms = Collections.emptyList();
-        signatureReferenceDigestMethods = Collections.emptyList();
+        signingCredentials = CollectionSupport.emptyList();
+        signatureAlgorithms = CollectionSupport.emptyList();
+        signatureReferenceDigestMethods = CollectionSupport.emptyList();
     }
     
     /** {@inheritDoc} */
@@ -88,9 +83,9 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      */
     public void setSigningCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
         if (credentials == null) {
-            signingCredentials = Collections.emptyList();
+            signingCredentials = CollectionSupport.emptyList();
         } else {
-            signingCredentials = List.copyOf(credentials);
+            signingCredentials = CollectionSupport.copyToList(credentials);
         }
     }
     
@@ -107,9 +102,9 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      */
     public void setSignatureAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
         if (algorithms == null) {
-            signatureAlgorithms = Collections.emptyList();
+            signatureAlgorithms = CollectionSupport.emptyList();
         } else {
-            signatureAlgorithms = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+            signatureAlgorithms = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
     }
     
@@ -126,9 +121,10 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
      */
     public void setSignatureReferenceDigestMethods(@Nullable @NonnullElements final List<String> algorithms) {
         if (algorithms == null) {
-            signatureReferenceDigestMethods = Collections.emptyList();
+            signatureReferenceDigestMethods = CollectionSupport.emptyList();
         } else {
-            signatureReferenceDigestMethods = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+            signatureReferenceDigestMethods =
+                    CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
         }
     }
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java
index f4e53c155..92eb15801 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java
@@ -19,7 +19,6 @@ package org.opensaml.xmlsec.impl;
 
 import java.security.Key;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Predicate;
 
@@ -27,8 +26,10 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -43,7 +44,6 @@ import org.opensaml.xmlsec.criterion.KeyInfoGenerationProfileCriterion;
 import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Basic implementation of {@link SignatureSigningParametersResolver}.
@@ -61,10 +61,10 @@ public class BasicSignatureSigningParametersResolver
         implements SignatureSigningParametersResolver {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(BasicSignatureSigningParametersResolver.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(BasicSignatureSigningParametersResolver.class);
     
     /** The AlgorithmRegistry used when processing algorithm URIs. */
-    private AlgorithmRegistry algorithmRegistry;
+    @Nullable private AlgorithmRegistry algorithmRegistry;
     
     /** Constructor. */
     public BasicSignatureSigningParametersResolver() {
@@ -77,11 +77,12 @@ public class BasicSignatureSigningParametersResolver
      * 
      * @return the algorithm registry instance
      */
-    public AlgorithmRegistry getAlgorithmRegistry() {
+    @Nonnull public AlgorithmRegistry getAlgorithmRegistry() {
         // Handle case where this resolver was constructed before the library was properly initialized.
         if (algorithmRegistry == null) {
-            return AlgorithmSupport.getGlobalAlgorithmRegistry();
+            return AlgorithmSupport.ensureGlobalAlgorithmRegistry();
         }
+        assert algorithmRegistry != null;
         return algorithmRegistry;
     }
 
@@ -96,19 +97,24 @@ public class BasicSignatureSigningParametersResolver
     }
 
     /** {@inheritDoc} */
-    @Nonnull
-    public Iterable<SignatureSigningParameters> resolve(@Nonnull final CriteriaSet criteria) throws ResolverException {
+    @Nonnull public Iterable<SignatureSigningParameters> resolve(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
         final SignatureSigningParameters params = resolveSingle(criteria);
         if (params != null) {
-            return Collections.singletonList(params);
+            return CollectionSupport.singletonList(params);
         }
-        return Collections.emptyList();
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
-    @Nullable
-    public SignatureSigningParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
-        Constraint.isNotNull(criteria, "CriteriaSet was null");
+    @Nullable public SignatureSigningParameters resolveSingle(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
+        
+        if (criteria == null) {
+            log.debug("CriteriaSet was null");
+            return null;
+        }
+
         Constraint.isNotNull(criteria.get(SignatureSigningConfigurationCriterion.class), 
                 "Resolver requires an instance of SignatureSigningConfigurationCriterion");
         
@@ -123,10 +129,11 @@ public class BasicSignatureSigningParametersResolver
         
         params.setSignatureCanonicalizationAlgorithm(resolveCanonicalizationAlgorithm(criteria));
         
-        if (params.getSigningCredential() != null) {
-            params.setKeyInfoGenerator(resolveKeyInfoGenerator(criteria, params.getSigningCredential()));
-            params.setSignatureHMACOutputLength(resolveHMACOutputLength(criteria, params.getSigningCredential(), 
-                    params.getSignatureAlgorithm()));
+        final Credential signingCred = params.getSigningCredential();
+        final String alg = params.getSignatureAlgorithm();
+        if (signingCred != null && alg != null) {
+            params.setKeyInfoGenerator(resolveKeyInfoGenerator(criteria, signingCred));
+            params.setSignatureHMACOutputLength(resolveHMACOutputLength(criteria, signingCred, alg));
         }
         
         if (validate(params)) {
@@ -145,7 +152,8 @@ public class BasicSignatureSigningParametersResolver
         if (log.isDebugEnabled()) {
             log.debug("Resolved SignatureSigningParameters:");
             
-            final Key signingKey = CredentialSupport.extractSigningKey(params.getSigningCredential());
+            final Credential signingCred = params.getSigningCredential();
+            final Key signingKey = signingCred != null ? CredentialSupport.extractSigningKey(signingCred) : null;
             if (signingKey != null) {
                 log.debug("\tSigning credential with key algorithm: {}", signingKey.getAlgorithm());
             } else {
@@ -154,8 +162,8 @@ public class BasicSignatureSigningParametersResolver
             
             log.debug("\tSignature algorithm URI: {}", params.getSignatureAlgorithm()); 
             
-            log.debug("\tSignature KeyInfoGenerator: {}", params.getKeyInfoGenerator() != null ?
-                    params.getKeyInfoGenerator().getClass().getName() : "null");
+            final KeyInfoGenerator generator = params.getKeyInfoGenerator();
+            log.debug("\tSignature KeyInfoGenerator: {}", generator != null ? generator.getClass().getName() : "null");
             
             log.debug("\tReference digest method algorithm URI: {}", params.getSignatureReferenceDigestMethod()); 
             log.debug("\tReference canonicalization algorithm URI: {}", 
@@ -201,22 +209,12 @@ public class BasicSignatureSigningParametersResolver
      * @return include/exclude predicate instance
      */
     @Nonnull protected Predicate<String> getIncludeExcludePredicate(@Nonnull final CriteriaSet criteria) {
-        return resolveIncludeExcludePredicate(criteria, 
-                criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations());
-    }
-
-    /**
-     * Get a predicate which implements the effective configured include/exclude policy.
-     * 
-     * @param criteria the input criteria being evaluated
-     * 
-     * @return include/exclude predicate instance
-     * 
-     * @deprecated
-     */
-    @Deprecated(since="4.1.0",forRemoval=true)
-    @Nonnull protected Predicate<String> getWhitelistBlacklistPredicate(@Nonnull final CriteriaSet criteria) {
-        return getIncludeExcludePredicate(criteria);
+        
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+        
+        return resolveIncludeExcludePredicate(criteria, criterion.getConfigurations());
     }
 
     /**
@@ -229,18 +227,20 @@ public class BasicSignatureSigningParametersResolver
      *          candidate signing method algorithm URIs
      */
     protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull final SignatureSigningParameters params, 
-            @Nonnull final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+            @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
         
         final List<Credential> credentials = getEffectiveSigningCredentials(criteria);
         final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
         log.trace("Resolved effective signature algorithms: {}", algorithms);
         
         for (final Credential credential : credentials) {
+            assert credential != null;
             if (log.isTraceEnabled()) {
                 final Key key = CredentialSupport.extractSigningKey(credential);
                 log.trace("Evaluating credential of type: {}", key != null ? key.getAlgorithm() : "n/a");
             }
             for (final String algorithm : algorithms) {
+                assert algorithm != null;
                 log.trace("Evaluating credential against algorithm: {}", algorithm);
                 if (credentialSupportsAlgorithm(credential, algorithm)) {
                     log.trace("Credential passed eval against algorithm: {}", algorithm);
@@ -285,9 +285,13 @@ public class BasicSignatureSigningParametersResolver
      * @return the list of credentials
      */
     @Nonnull protected List<Credential> getEffectiveSigningCredentials(@Nonnull final CriteriaSet criteria) {
+
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+
         final ArrayList<Credential> accumulator = new ArrayList<>();
-        for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                .getConfigurations()) {
+        for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
             
             accumulator.addAll(config.getSigningCredentials());
             
@@ -305,9 +309,13 @@ public class BasicSignatureSigningParametersResolver
      */
     @Nonnull protected List<String> getEffectiveSignatureAlgorithms(@Nonnull final CriteriaSet criteria, 
             @Nonnull final Predicate<String> includeExcludePredicate) {
+
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+
         final ArrayList<String> accumulator = new ArrayList<>();
-        for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                .getConfigurations()) {
+        for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
             
             config.getSignatureAlgorithms()
                 .stream()
@@ -326,8 +334,12 @@ public class BasicSignatureSigningParametersResolver
      */
     @Nullable protected String resolveReferenceDigestMethod(@Nonnull final CriteriaSet criteria, 
             @Nonnull final Predicate<String> includeExcludePredicate) {
-        for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                .getConfigurations()) {
+
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
             
             for (final String digestMethod : config.getSignatureReferenceDigestMethods()) {
                 if (getAlgorithmRuntimeSupportedPredicate().test(digestMethod) 
@@ -347,14 +359,17 @@ public class BasicSignatureSigningParametersResolver
      * @return the canonicalization algorithm URI
      */
     @Nullable protected String resolveCanonicalizationAlgorithm(@Nonnull final CriteriaSet criteria) {
-        for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                .getConfigurations()) {
-            
+
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
             if (config.getSignatureCanonicalizationAlgorithm() != null) {
                 return config.getSignatureCanonicalizationAlgorithm();
             }
-            
         }
+        
         return null;
     }
     
@@ -365,14 +380,17 @@ public class BasicSignatureSigningParametersResolver
      * @return the reference canonicalization algorithm URI
      */
     @Nullable protected String resolveReferenceCanonicalizationAlgorithm(@Nonnull final CriteriaSet criteria) {
-        for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                .getConfigurations()) {
-            
+
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
             if (config.getSignatureReferenceCanonicalizationAlgorithm() != null) {
                 return config.getSignatureReferenceCanonicalizationAlgorithm();
             }
-            
         }
+        
         return null;
     }
 
@@ -386,20 +404,20 @@ public class BasicSignatureSigningParametersResolver
     @Nullable protected KeyInfoGenerator resolveKeyInfoGenerator(@Nonnull final CriteriaSet criteria, 
             @Nonnull final Credential signingCredential) {
         
-        String name = null;
-        if (criteria.get(KeyInfoGenerationProfileCriterion.class) != null) {
-            name = criteria.get(KeyInfoGenerationProfileCriterion.class).getName();
-        }
+        final KeyInfoGenerationProfileCriterion keyInfoGenCriterion =
+                criteria.get(KeyInfoGenerationProfileCriterion.class);
+        final String name = keyInfoGenCriterion != null ? keyInfoGenCriterion.getName() : null;
         
-        for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                .getConfigurations()) {
-            
+        final SignatureSigningConfigurationCriterion criterion =
+                criteria.get(SignatureSigningConfigurationCriterion.class);
+        assert criterion != null;
+
+        for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
             final KeyInfoGenerator kig =
                     lookupKeyInfoGenerator(signingCredential, config.getKeyInfoGeneratorManager(), name);
             if (kig != null) {
                 return kig;
             }
-            
         }
         
         return null;
@@ -418,13 +436,18 @@ public class BasicSignatureSigningParametersResolver
             @Nonnull final Credential signingCredential, @Nonnull @NotEmpty final String algorithmURI) {
         
         if (AlgorithmSupport.isHMAC(algorithmURI)) {
-            for (final SignatureSigningConfiguration config : criteria.get(SignatureSigningConfigurationCriterion.class)
-                    .getConfigurations()) {
+
+            final SignatureSigningConfigurationCriterion criterion =
+                    criteria.get(SignatureSigningConfigurationCriterion.class);
+            assert criterion != null;
+
+            for (final SignatureSigningConfiguration config : criterion.getConfigurations()) {
                 if (config.getSignatureHMACOutputLength() != null) {
                     return config.getSignatureHMACOutputLength();
                 }
             }
         }
+        
         return null;
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java
index b57a6665b..3ad1f28d8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java
@@ -17,12 +17,12 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -32,7 +32,6 @@ import org.opensaml.xmlsec.SignatureValidationParametersResolver;
 import org.opensaml.xmlsec.criterion.SignatureValidationConfigurationCriterion;
 import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Basic implementation of {@link SignatureValidationParametersResolver}.
@@ -49,30 +48,35 @@ public class BasicSignatureValidationParametersResolver
         implements SignatureValidationParametersResolver {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(BasicSignatureValidationParametersResolver.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(BasicSignatureValidationParametersResolver.class);
 
     /** {@inheritDoc} */
-    @Nonnull public Iterable<SignatureValidationParameters> resolve(@Nonnull final CriteriaSet criteria) 
+    @Nonnull public Iterable<SignatureValidationParameters> resolve(@Nullable final CriteriaSet criteria) 
             throws ResolverException {
         
         final SignatureValidationParameters params = resolveSingle(criteria);
         if (params != null) {
-            return Collections.singletonList(params);
+            return CollectionSupport.singletonList(params);
         }
-        return Collections.emptyList();
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
-    @Nullable
-    public SignatureValidationParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
-        Constraint.isNotNull(criteria, "CriteriaSet was null");
-        Constraint.isNotNull(criteria.get(SignatureValidationConfigurationCriterion.class), 
-                "Resolver requires an instance of SignatureValidationConfigurationCriterion");
+    @Nullable public SignatureValidationParameters resolveSingle(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
+        
+        if (criteria == null) {
+            log.debug("CriteriaSet was null");
+            return null;
+        }
+        
+        final SignatureValidationConfigurationCriterion criterion =
+                Constraint.isNotNull(criteria.get(SignatureValidationConfigurationCriterion.class),
+                        "Resolver requires an instance of SignatureValidationConfigurationCriterion");
         
         final SignatureValidationParameters params = new SignatureValidationParameters();
         
-        resolveAndPopulateIncludesExcludes(params, criteria, 
-                criteria.get(SignatureValidationConfigurationCriterion.class).getConfigurations());
+        resolveAndPopulateIncludesExcludes(params, criteria, criterion.getConfigurations());
         
         params.setSignatureTrustEngine(resolveSignatureTrustEngine(criteria));
         
@@ -107,9 +111,11 @@ public class BasicSignatureValidationParametersResolver
      */
     @Nullable protected SignatureTrustEngine resolveSignatureTrustEngine(@Nonnull final CriteriaSet criteria) {
         
-        for (final SignatureValidationConfiguration config : criteria
-                .get(SignatureValidationConfigurationCriterion.class)
-                .getConfigurations()) {
+        final SignatureValidationConfigurationCriterion criterion =
+                criteria.get(SignatureValidationConfigurationCriterion.class);
+        assert criterion != null;
+        
+        for (final SignatureValidationConfiguration config : criterion.getConfigurations()) {
             if (config.getSignatureTrustEngine() != null) {
                 return config.getSignatureTrustEngine();
             }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
index b83dbfb94..40748cc79 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
@@ -18,13 +18,13 @@
 package org.opensaml.xmlsec.impl;
 
 import java.util.Collection;
-import java.util.Set;
 import java.util.function.Predicate;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -41,7 +41,7 @@ public class ExcludedAlgorithmsPredicate implements Predicate<String> {
      * @param algorithms collection of excluded algorithms
      */
     public ExcludedAlgorithmsPredicate(@Nonnull @NonnullElements final Collection<String> algorithms) {
-        excludes = Set.copyOf(Constraint.isNotNull(algorithms, "Exclusions may not be null"));
+        excludes = CollectionSupport.copyToSet(Constraint.isNotNull(algorithms, "Exclusions may not be null"));
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
index 0b209ec0a..89418c687 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
@@ -18,13 +18,13 @@
 package org.opensaml.xmlsec.impl;
 
 import java.util.Collection;
-import java.util.Set;
 import java.util.function.Predicate;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -42,7 +42,7 @@ public class IncludedAlgorithmsPredicate implements Predicate<String> {
      * @param algorithms collection of included algorithms
      */
     public IncludedAlgorithmsPredicate(@Nonnull final Collection<String> algorithms) {
-        includes = Set.copyOf(Constraint.isNotNull(algorithms, "Inclusions may not be null"));
+        includes = CollectionSupport.copyToSet(Constraint.isNotNull(algorithms, "Inclusions may not be null"));
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticDecryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticDecryptionParametersResolver.java
index 7c158358e..8e8510ff2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticDecryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticDecryptionParametersResolver.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -34,25 +34,26 @@ import org.opensaml.xmlsec.DecryptionParametersResolver;
 public class StaticDecryptionParametersResolver implements DecryptionParametersResolver {
     
     /** Static parameters. */
-    private DecryptionParameters params;
+    @Nonnull private DecryptionParameters params;
     
     /**
      * Constructor.
      *
      * @param parameters the static parameters instance to return
      */
-    public StaticDecryptionParametersResolver(final DecryptionParameters parameters) {
+    public StaticDecryptionParametersResolver(@Nonnull final DecryptionParameters parameters) {
         params = Constraint.isNotNull(parameters, "Parameters instance may not be null");
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Iterable<DecryptionParameters> resolve(final CriteriaSet criteria) throws ResolverException {
-        return Collections.singleton(params);
+    @Nonnull public Iterable<DecryptionParameters> resolve(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
+        return CollectionSupport.singleton(params);
     }
 
     /** {@inheritDoc} */
-    @Nonnull public DecryptionParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
+    @Nullable public DecryptionParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
         return params;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticEncryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticEncryptionParametersResolver.java
index a994a22c0..26f04c114 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticEncryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticEncryptionParametersResolver.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -34,25 +34,26 @@ import org.opensaml.xmlsec.EncryptionParametersResolver;
 public class StaticEncryptionParametersResolver implements EncryptionParametersResolver {
     
     /** Static parameters. */
-    private EncryptionParameters params;
+    @Nonnull private EncryptionParameters params;
     
     /**
      * Constructor.
      *
      * @param parameters the static parameters instance to return
      */
-    public StaticEncryptionParametersResolver(final EncryptionParameters parameters) {
+    public StaticEncryptionParametersResolver(@Nonnull final EncryptionParameters parameters) {
         params = Constraint.isNotNull(parameters, "Parameters instance may not be null");
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Iterable<EncryptionParameters> resolve(final CriteriaSet criteria) throws ResolverException {
-        return Collections.singleton(params);
+    @Nonnull public Iterable<EncryptionParameters> resolve(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
+        return CollectionSupport.singleton(params);
     }
 
     /** {@inheritDoc} */
-    @Nonnull public EncryptionParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
+    @Nullable public EncryptionParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
         return params;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureSigningParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureSigningParametersResolver.java
index 99041bc63..c43c33ec3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureSigningParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureSigningParametersResolver.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -34,24 +34,26 @@ import org.opensaml.xmlsec.SignatureSigningParametersResolver;
 public class StaticSignatureSigningParametersResolver implements SignatureSigningParametersResolver {
     
     /** Static parameters. */
-    private SignatureSigningParameters params;
+    @Nonnull private SignatureSigningParameters params;
     
     /**
      * Constructor.
      *
      * @param parameters the static parameters instance to return
      */
-    public StaticSignatureSigningParametersResolver(final SignatureSigningParameters parameters) {
+    public StaticSignatureSigningParametersResolver(@Nonnull final SignatureSigningParameters parameters) {
         params = Constraint.isNotNull(parameters, "Parameters instance may not be null");
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Iterable<SignatureSigningParameters> resolve(final CriteriaSet criteria) throws ResolverException {
-        return Collections.singleton(params);
+    @Nonnull public Iterable<SignatureSigningParameters> resolve(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
+        return CollectionSupport.singleton(params);
     }
 
     /** {@inheritDoc} */
-    @Nonnull public SignatureSigningParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
+    @Nullable public SignatureSigningParameters resolveSingle(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
         return params;
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureValidationParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureValidationParametersResolver.java
index 2c7a463e7..c66e21ed9 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureValidationParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/StaticSignatureValidationParametersResolver.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -34,25 +34,26 @@ import org.opensaml.xmlsec.SignatureValidationParametersResolver;
 public class StaticSignatureValidationParametersResolver implements SignatureValidationParametersResolver {
     
     /** Static parameters. */
-    private SignatureValidationParameters params;
+    @Nonnull private SignatureValidationParameters params;
     
     /**
      * Constructor.
      *
      * @param parameters the static parameters instance to return
      */
-    public StaticSignatureValidationParametersResolver(final SignatureValidationParameters parameters) {
+    public StaticSignatureValidationParametersResolver(@Nonnull final SignatureValidationParameters parameters) {
         params = Constraint.isNotNull(parameters, "Parameters instance may not be null");
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Iterable<SignatureValidationParameters> resolve(final CriteriaSet criteria)
+    @Nonnull public Iterable<SignatureValidationParameters> resolve(@Nullable final CriteriaSet criteria)
             throws ResolverException {
-        return Collections.singleton(params);
+        return CollectionSupport.singleton(params);
     }
 
     /** {@inheritDoc} */
-    @Nonnull public SignatureValidationParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
+    @Nullable  public SignatureValidationParameters resolveSingle(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
         return params;
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java
index 6f841598b..cb39d13fe 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorFactory.java
@@ -18,6 +18,7 @@
 package org.opensaml.xmlsec.keyinfo.impl;
 
 import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
 import java.security.spec.InvalidKeySpecException;
 import java.util.HashMap;
 import java.util.List;
@@ -62,7 +63,7 @@ public class BasicKeyInfoGeneratorFactory implements KeyInfoGeneratorFactory {
     }
     
     /** The set of options configured for the factory. */
-    private final BasicOptions options;
+    @Nonnull private final BasicOptions options;
     
     /**
      * Constructor.
@@ -245,7 +246,7 @@ public class BasicKeyInfoGeneratorFactory implements KeyInfoGeneratorFactory {
          * 
          * @throws SecurityException if class type can not be mapped to an element {@link QName}
          */
-        protected KeyInfo buildKeyInfo() throws SecurityException {
+        @Nonnull protected KeyInfo buildKeyInfo() throws SecurityException {
             final QName elementName = classToElementName(keyInfoType);
             if (elementName == null) { 
                 throw new SecurityException("KeyInfo type not mapped to an element QName: "
@@ -308,17 +309,19 @@ public class BasicKeyInfoGeneratorFactory implements KeyInfoGeneratorFactory {
          */
         protected void processPublicKey(@Nonnull final KeyInfo keyInfo, @Nonnull final Credential credential)
             throws SecurityException {
-            if (credential.getPublicKey() != null) {
+            
+            final PublicKey key = credential.getPublicKey();
+            if (key != null) {
                 if (options.emitPublicKeyValue) {
                     try {
-                        KeyInfoSupport.addPublicKey(keyInfo, credential.getPublicKey());
+                        KeyInfoSupport.addPublicKey(keyInfo, key);
                     } catch (final EncodingException e) {
                         throw new SecurityException("Can't add public key to key info",e);
                     }
                 }
                 if (options.emitPublicDEREncodedKeyValue) {
                     try {
-                        KeyInfoSupport.addDEREncodedPublicKey(keyInfo, credential.getPublicKey());
+                        KeyInfoSupport.addDEREncodedPublicKey(keyInfo, key);
                     } catch (final NoSuchAlgorithmException e) {
                         throw new SecurityException("Can't DER-encode key, unsupported key algorithm", e);
                     } catch (final InvalidKeySpecException e) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java
index 164aa7e35..6d163f2cd 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/BasicProviderKeyInfoCredentialResolver.java
@@ -45,9 +45,9 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.KeyName;
 import org.opensaml.xmlsec.signature.KeyValue;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -109,10 +109,10 @@ public class BasicProviderKeyInfoCredentialResolver extends AbstractCriteriaFilt
         KeyInfoCredentialResolver {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(BasicProviderKeyInfoCredentialResolver.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(BasicProviderKeyInfoCredentialResolver.class);
 
     /** List of KeyInfo providers that are registered on this instance. */
-    private final List<KeyInfoProvider> providers;
+    @Nonnull private final List<KeyInfoProvider> providers;
 
     /**
      * Constructor.
@@ -121,8 +121,6 @@ public class BasicProviderKeyInfoCredentialResolver extends AbstractCriteriaFilt
      */
     public BasicProviderKeyInfoCredentialResolver(
             @Nonnull @ParameterName(name="keyInfoProviders") final List<KeyInfoProvider> keyInfoProviders) {
-        super();
-
         providers = new ArrayList<>();
         providers.addAll(keyInfoProviders);
     }
@@ -265,7 +263,12 @@ public class BasicProviderKeyInfoCredentialResolver extends AbstractCriteriaFilt
             @Nullable final CriteriaSet criteriaSet, @Nonnull final List<Credential> credentials)
                     throws ResolverException {
 
-        for (final XMLObject keyInfoChild : kiContext.getKeyInfo().getXMLObjects()) {
+        final KeyInfo keyInfo = kiContext.getKeyInfo();
+        if (keyInfo == null) {
+            return;
+        }
+        
+        for (final XMLObject keyInfoChild : keyInfo.getXMLObjects()) {
 
             if (keyInfoChild instanceof KeyValue || keyInfoChild instanceof DEREncodedKeyValue) {
                 continue;
@@ -429,11 +432,7 @@ public class BasicProviderKeyInfoCredentialResolver extends AbstractCriteriaFilt
             final PrivateKey privateKey = (PrivateKey) key;
             try {
                 final PublicKey publicKey = KeySupport.derivePublicKey(privateKey);
-                if (publicKey != null) {
-                    basicCred = new BasicCredential(publicKey, privateKey);
-                } else {
-                    log.error("Failed to derive public key from private key");
-                }
+                basicCred = new BasicCredential(publicKey, privateKey);
             } catch (final KeyException e) {
                 log.error("Could not derive public key from private key", e);
             }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java
index e7bb7ad70..2feda4bb6 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyAgreementKeyInfoGeneratorFactory.java
@@ -34,10 +34,12 @@ import org.opensaml.xmlsec.encryption.KANonce;
 import org.opensaml.xmlsec.encryption.OriginatorKeyInfo;
 import org.opensaml.xmlsec.encryption.RecipientKeyInfo;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
+import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A factory implementation which produces instances of {@link KeyInfoGenerator} capable of 
@@ -46,11 +48,10 @@ import org.slf4j.LoggerFactory;
 public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
     
     /** The set of options configured for the factory. */
-    private final KeyAgreementOptions options;
+    @Nonnull private final KeyAgreementOptions options;
     
     /** Constructor. */
     public KeyAgreementKeyInfoGeneratorFactory() {
-        super();
         options = (KeyAgreementOptions) super.getOptions();
     }
     
@@ -163,7 +164,7 @@ public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFa
     public class KeyAgreementKeyInfoGenerator extends BasicKeyInfoGenerator {
 
         /** Class logger. */
-        private final Logger log = LoggerFactory.getLogger(KeyAgreementKeyInfoGenerator.class);
+        @Nonnull private final Logger log = LoggerFactory.getLogger(KeyAgreementKeyInfoGenerator.class);
         
         /** The set of options to be used by the generator.*/
         private KeyAgreementOptions options;
@@ -177,7 +178,7 @@ public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFa
          * @param newOptions the options to be used by the generator
          * @param type the KeyInfo element type
          */
-        protected KeyAgreementKeyInfoGenerator(final KeyAgreementOptions newOptions,
+        protected KeyAgreementKeyInfoGenerator(@Nonnull final KeyAgreementOptions newOptions,
                 final Class<? extends KeyInfo> type) {
             super(newOptions, type);
             options = newOptions;
@@ -261,17 +262,19 @@ public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFa
             
             if (options.emitOriginatorKeyInfo) {
                 if (options.originatorKeyInfoGeneratorManager == null) {
-                    log.warn("KeyInfoGeneratorManager for OriginatorKeyInfo is null, can not process");
+                    log.warn("KeyInfoGeneratorManager for OriginatorKeyInfo is null, cannot process");
                     return;
                 }
-                if (credential.getOriginatorCredential() == null) {
-                    log.warn("KeyAgreementCredential originator credential is null, can not process");
+
+                assert options.originatorKeyInfoGeneratorManager != null;
+                final KeyInfoGeneratorFactory factory = options.originatorKeyInfoGeneratorManager
+                        .getFactory(credential.getOriginatorCredential());
+                if (factory == null) {
+                    log.warn("KeyInfoGeneratorFactory for OriginatorKeyInfo is unavailable");
                     return;
                 }
-
-                final KeyInfo originatorKeyInfo = options.originatorKeyInfoGeneratorManager
-                        .getFactory(credential.getOriginatorCredential())
-                        .newInstance(OriginatorKeyInfo.class)
+                
+                final KeyInfo originatorKeyInfo = factory.newInstance(OriginatorKeyInfo.class)
                         .generate(credential.getOriginatorCredential());
                 if (originatorKeyInfo == null) {
                     log.warn("Failed to generate KeyInfo from KeyAgreementCredential originator Credential");
@@ -301,17 +304,19 @@ public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFa
             
             if (options.emitRecipientKeyInfo) {
                 if (options.recipientKeyInfoGeneratorManager == null) {
-                    log.warn("KeyInfoGeneratorManager for RecipientKeyInfo is null, can not process");
+                    log.warn("KeyInfoGeneratorManager for RecipientKeyInfo is null, cannot process");
                     return;
                 }
-                if (credential.getRecipientCredential() == null) {
-                    log.warn("KeyAgreementCredential recipient credential is null, can not process");
+                
+                assert options.recipientKeyInfoGeneratorManager != null;
+                final KeyInfoGeneratorFactory factory = options.recipientKeyInfoGeneratorManager
+                        .getFactory(credential.getRecipientCredential());
+                if (factory == null) {
+                    log.warn("KeyInfoGeneratorFactory for RecipientKeyInfo is unavailable");
                     return;
                 }
                 
-                final KeyInfo recipientKeyInfo = options.recipientKeyInfoGeneratorManager
-                        .getFactory(credential.getRecipientCredential())
-                        .newInstance(RecipientKeyInfo.class)
+                final KeyInfo recipientKeyInfo = factory.newInstance(RecipientKeyInfo.class)
                         .generate(credential.getRecipientCredential());
                 if (recipientKeyInfo == null) {
                     log.warn("Failed to generate KeyInfo from KeyAgreementCredential recipient Credential");
@@ -341,10 +346,10 @@ public class KeyAgreementKeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFa
        private boolean emitRecipientKeyInfo;
        
        /** KeyInfo generator manager for OriginatorKeyInfo elements. */
-       private KeyInfoGeneratorManager  originatorKeyInfoGeneratorManager;
+       @Nullable private KeyInfoGeneratorManager  originatorKeyInfoGeneratorManager;
        
        /** KeyInfo generator manager for RecipientKeyInfo elements. */
-       private KeyInfoGeneratorManager recipientKeyInfoGeneratorManager;
+       @Nullable private KeyInfoGeneratorManager recipientKeyInfoGeneratorManager;
        
        /** Constructor. */
        protected KeyAgreementOptions() {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoCredentialContext.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoCredentialContext.java
index b12d36491..dd45969fc 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoCredentialContext.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoCredentialContext.java
@@ -30,7 +30,7 @@ import net.shibboleth.shared.annotation.ParameterName;
 public class KeyInfoCredentialContext implements CredentialContext {
     
     /** The KeyInfo context. */
-    private final KeyInfo keyInfo;
+    @Nonnull private final KeyInfo keyInfo;
     
     /**
      * Constructor.
@@ -49,4 +49,5 @@ public class KeyInfoCredentialContext implements CredentialContext {
     @Nonnull public KeyInfo getKeyInfo() {
         return keyInfo;
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java
index 70844701d..d80a27a4d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoResolutionContext.java
@@ -19,7 +19,6 @@ package org.opensaml.xmlsec.keyinfo.impl;
 
 import java.security.Key;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
 
@@ -30,10 +29,10 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyMap;
 import net.shibboleth.shared.collection.LazySet;
 
-
 /**
  *  Resolution context class that is used to supply state information to, and to share information
  *  amongst, {@link KeyInfoProvider}s.
@@ -50,23 +49,23 @@ import net.shibboleth.shared.collection.LazySet;
 public class KeyInfoResolutionContext {
     
     /** The KeyInfo being processed. */
-    private KeyInfo keyInfo;
+    @Nullable private KeyInfo keyInfo;
     
     /** Key names which are known to be associated with the KeyInfo being processed.
      * These may have for example been extracted from KeyName elements present,
      * or may have been inferred from the context in which the KeyInfo exists or
      * is being used. */
-    private final Set<String> keyNames;
+    @Nonnull private final Set<String> keyNames;
     
     /** Get the key currently known to be represented by the KeyInfo. */
-    private Key key;
+    @Nullable private Key key;
     
     /** This list provides KeyInfo resolvers and providers in a particular processing
      * environment access to credentials that may have already been previously resolved. */
-    private final Collection<Credential> resolvedCredentials;
+    @Nonnull private final Collection<Credential> resolvedCredentials;
     
     /** Extensible map of properties used to share state amongst providers and/or resolver logic. */
-    private final Map<String, Object> properties;
+    @Nonnull private final Map<String, Object> properties;
     
     /**
      * Constructor.
@@ -76,7 +75,7 @@ public class KeyInfoResolutionContext {
      */
     public KeyInfoResolutionContext(
             @Nonnull @ParameterName(name="credentials") final Collection<Credential> credentials) {
-        resolvedCredentials = Collections.unmodifiableCollection(credentials);
+        resolvedCredentials = CollectionSupport.copyToList(credentials);
         properties = new LazyMap<>();
         keyNames = new LazySet<>();
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java
index d818c1490..8b1dfdf8d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolver.java
@@ -32,10 +32,10 @@ import org.opensaml.security.criteria.PublicKeyCriterion;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolutionMode;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolutionMode.Mode;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -75,10 +75,10 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class LocalKeyInfoCredentialResolver extends BasicProviderKeyInfoCredentialResolver {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(LocalKeyInfoCredentialResolver.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(LocalKeyInfoCredentialResolver.class);
     
     /** The resolver which is used to resolve local credentials. */
-    private final CredentialResolver localCredResolver;
+    @Nonnull private final CredentialResolver localCredResolver;
 
     /**
      * Constructor.
@@ -112,8 +112,9 @@ public class LocalKeyInfoCredentialResolver extends BasicProviderKeyInfoCredenti
             @Nullable final CriteriaSet criteriaSet, @Nonnull final List<Credential> credentials)
                     throws ResolverException {
         
-        final Mode mode = criteriaSet.contains(KeyInfoCredentialResolutionMode.class)
-                ? criteriaSet.get(KeyInfoCredentialResolutionMode.class).getMode() : Mode.LOCAL;
+        final KeyInfoCredentialResolutionMode modeCriterion = criteriaSet != null
+                ? criteriaSet.get(KeyInfoCredentialResolutionMode.class) : null;
+        final Mode mode = modeCriterion != null ? modeCriterion.getMode() : Mode.LOCAL;
 
         log.debug("Resolution mode in effect is: {}", mode);
 
@@ -125,27 +126,32 @@ public class LocalKeyInfoCredentialResolver extends BasicProviderKeyInfoCredenti
         final ArrayList<Credential> results = new ArrayList<>();
         
         for (final Credential inputCred : credentials) {
+            assert inputCred != null;
             if (isLocalCredential(inputCred)) {
                 log.debug("Input credential was local, including in results");
                 results.add(inputCred);
-            } else if (inputCred.getPublicKey() != null) {
-                final Collection<? extends Credential> localCreds = resolveByPublicKey(inputCred.getPublicKey());
-                if (!localCreds.isEmpty()) {
-                    log.debug("Input credential was public, resolved to local credential(s), adding to results");
-                    results.addAll(localCreds);
-                } else if (Mode.BOTH == mode) {
-                    log.debug("Input credential was public, did not resolve to local credential(s), "
-                            + "BOTH mode in effect, including in results");
-                    results.add(inputCred);
-                } else {
-                    log.debug("Input credential was public, did not resolve to local credential(s), "
-                            + "LOCAL mode in effect, omitting from results");
+            } else {
+                final PublicKey publicKey = inputCred.getPublicKey();
+                if (publicKey != null) {
+                    final Collection<? extends Credential> localCreds = resolveByPublicKey(publicKey);
+                    if (!localCreds.isEmpty()) {
+                        log.debug("Input credential was public, resolved to local credential(s), adding to results");
+                        results.addAll(localCreds);
+                    } else if (Mode.BOTH == mode) {
+                        log.debug("Input credential was public, did not resolve to local credential(s), "
+                                + "BOTH mode in effect, including in results");
+                        results.add(inputCred);
+                    } else {
+                        log.debug("Input credential was public, did not resolve to local credential(s), "
+                                + "LOCAL mode in effect, omitting from results");
+                    }
                 }
             }
         }
         
         // Also resolve local credentials based on any key names that are known
         for (final String keyName : kiContext.getKeyNames()) {
+            assert keyName != null;
             results.addAll(resolveByKeyName(keyName));
         }
         
@@ -179,6 +185,7 @@ public class LocalKeyInfoCredentialResolver extends BasicProviderKeyInfoCredenti
         
         final CriteriaSet criteriaSet = new CriteriaSet( new KeyNameCriterion(keyName) );
         for (final Credential cred : getLocalCredentialResolver().resolve(criteriaSet)) {
+            assert cred != null;
             if (isLocalCredential(cred)) {
                 localCreds.add(cred);
             }
@@ -202,6 +209,7 @@ public class LocalKeyInfoCredentialResolver extends BasicProviderKeyInfoCredenti
         
         final CriteriaSet criteriaSet = new CriteriaSet( new PublicKeyCriterion(publicKey) );
         for (final Credential cred : getLocalCredentialResolver().resolve(criteriaSet)) {
+            assert cred != null;
             if (isLocalCredential(cred)) {
                 localCreds.add(cred);
             }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGenerator.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGenerator.java
index 982d16846..65b77701f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGenerator.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGenerator.java
@@ -49,13 +49,13 @@ import net.shibboleth.shared.logic.Constraint;
 public class StaticKeyInfoGenerator implements KeyInfoGenerator {
     
     /** The KeyInfo object held by this generator instance. */
-    private KeyInfo keyInfo;
+    @Nonnull private KeyInfo keyInfo;
     
     /** Unmarshaller used in cloning operation. */
-    private Unmarshaller keyInfoUnmarshaller;
+    @Nullable private Unmarshaller keyInfoUnmarshaller;
     
     /** Marshaller used in cloning operation. */
-    private Marshaller keyInfoMarshaller;
+    @Nullable private Marshaller keyInfoMarshaller;
     
     /**
      * Constructor.
@@ -63,11 +63,10 @@ public class StaticKeyInfoGenerator implements KeyInfoGenerator {
      * @param newKeyInfo the KeyInfo used as the basis to return new KeyInfo objects from this generator
      */
     public StaticKeyInfoGenerator(@Nonnull @ParameterName(name="newKeyInfo") final KeyInfo newKeyInfo) {
-        setKeyInfo(newKeyInfo);
+        keyInfo = Constraint.isNotNull(newKeyInfo, "KeyInfo cannot be null");
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull public KeyInfo generate(@Nullable final Credential credential) throws SecurityException {
         if (keyInfo.getParent() == null) {
             return keyInfo;
@@ -116,7 +115,9 @@ public class StaticKeyInfoGenerator implements KeyInfoGenerator {
         
         KeyInfo newKeyInfo = null;
         try {
-            newKeyInfo = (KeyInfo) getUnmarshaller().unmarshall(origKeyInfo.getDOM());
+            final Element newDOM = origKeyInfo.getDOM();
+            assert newDOM != null;
+            newKeyInfo = (KeyInfo) getUnmarshaller().unmarshall(newDOM);
         } catch (final UnmarshallingException e) {
             throw new SecurityException("Error unmarshalling the new KeyInfo during cloning", e);
         }
@@ -148,6 +149,8 @@ public class StaticKeyInfoGenerator implements KeyInfoGenerator {
                 throw new SecurityException("Could not obtain KeyInfo marshaller from the configuration");
             }
         }
+        
+        assert keyInfoMarshaller != null;
         return keyInfoMarshaller;
     }
 
@@ -165,6 +168,8 @@ public class StaticKeyInfoGenerator implements KeyInfoGenerator {
                 throw new SecurityException("Could not obtain KeyInfo unmarshaller from the configuration");
             }
         }
+        
+        assert keyInfoUnmarshaller != null;
         return keyInfoUnmarshaller;
     }
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java
index 6101099ec..ace912af8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorFactory.java
@@ -20,6 +20,7 @@ package org.opensaml.xmlsec.keyinfo.impl;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.CRLException;
 import java.security.cert.CertificateEncodingException;
+import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 
@@ -62,11 +63,10 @@ import net.shibboleth.shared.logic.Constraint;
 public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
     
     /** The set of options configured for the factory. */
-    private final X509Options options;
+    @Nonnull private final X509Options options;
     
     /** Constructor. */
     public X509KeyInfoGeneratorFactory() {
-        super();
         options = (X509Options) super.getOptions();
     }
     
@@ -460,10 +460,6 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
         protected void processEntityCertificate(@Nonnull final KeyInfo keyInfo, @Nonnull final X509Data x509Data,
                 @Nonnull final X509Credential credential) throws SecurityException {
             
-            if (credential.getEntityCertificate() == null) {
-                return;
-            }
-            
             final java.security.cert.X509Certificate javaCert = credential.getEntityCertificate();
             
             processCertX509DataOptions(x509Data, javaCert);
@@ -607,7 +603,7 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
          * @param cert the certificate being processed
          * @return the issuer name
          */
-        protected String getIssuerName(@Nullable final java.security.cert.X509Certificate cert) {
+        @Nullable protected String getIssuerName(@Nullable final java.security.cert.X509Certificate cert) {
             if (cert == null) {
                 return null;
             } else if (!Strings.isNullOrEmpty(options.x500IssuerDNFormat)) {
@@ -625,7 +621,7 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
          * @param cert the certificate being processed
          */
         protected void processSubjectDNKeyName(@Nonnull final KeyInfo keyInfo,
-                @Nullable final java.security.cert.X509Certificate cert) {
+                @Nonnull final java.security.cert.X509Certificate cert) {
             if (options.emitSubjectDNAsKeyName) {
                 final String subjectNameValue = getSubjectName(cert);
                 if (!Strings.isNullOrEmpty(subjectNameValue)) {
@@ -642,7 +638,7 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
          * @param cert the certificate being processed
          */
         protected void processSubjectCNKeyName(@Nonnull final KeyInfo keyInfo,
-                @Nullable final java.security.cert.X509Certificate cert) {
+                @Nonnull final java.security.cert.X509Certificate cert) {
             if (options.emitSubjectCNAsKeyName) {
                 final List<String> cnames = X509Support.getCommonNames(cert.getSubjectX500Principal());
                 if (cnames != null) {
@@ -663,7 +659,7 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
          * @param cert the certificate being processed
          */
         protected void processSubjectAltNameKeyNames(@Nonnull final KeyInfo keyInfo,
-                @Nullable final java.security.cert.X509Certificate cert) {
+                @Nonnull final java.security.cert.X509Certificate cert) {
             if (options.emitSubjectAltNamesAsKeyNames && options.subjectAltNames.size() > 0) {
                 final Integer[] nameTypes = new Integer[ options.subjectAltNames.size() ];
                 options.subjectAltNames.toArray(nameTypes);
@@ -719,13 +715,16 @@ public class X509KeyInfoGeneratorFactory extends BasicKeyInfoGeneratorFactory {
                 @Nonnull final X509Credential credential) throws SecurityException {
             
             if (options.emitCRLs && credential.getCRLs() != null) {
-                for (final java.security.cert.X509CRL javaCRL : credential.getCRLs()) {
-                    try {
-                        final X509CRL xmlCRL = KeyInfoSupport.buildX509CRL(javaCRL);
-                        x509Data.getX509CRLs().add(xmlCRL);
-                    } catch (final CRLException e) {
-                        throw new SecurityException("Error generating X509CRL element " 
-                                + "from a CRL in credential's CRL list", e);
+                final Collection<java.security.cert.X509CRL> crls = credential.getCRLs();
+                if (crls != null) {
+                    for (final java.security.cert.X509CRL javaCRL : crls) {
+                        try {
+                            final X509CRL xmlCRL = KeyInfoSupport.buildX509CRL(javaCRL);
+                            x509Data.getX509CRLs().add(xmlCRL);
+                        } catch (final CRLException e) {
+                            throw new SecurityException("Error generating X509CRL element " 
+                                    + "from a CRL in credential's CRL list", e);
+                        }
                     }
                 }
             }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AbstractKeyInfoProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AbstractKeyInfoProvider.java
index ef99d0131..e8fb62b83 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AbstractKeyInfoProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AbstractKeyInfoProvider.java
@@ -25,6 +25,7 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoCredentialContext;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
+import org.opensaml.xmlsec.signature.KeyInfo;
 
 /**
  * Abstract super class for {@link KeyInfoProvider} implementations.
@@ -66,8 +67,9 @@ public abstract class AbstractKeyInfoProvider implements KeyInfoProvider {
             @Nullable final KeyInfoResolutionContext kiContext) {
         // Simple for now, might do other stuff later.
         // Just want to provide a single place to build credential contexts for a provider.
-        if (kiContext != null) {
-            return new KeyInfoCredentialContext(kiContext.getKeyInfo());
+        final KeyInfo keyInfo = kiContext != null ? kiContext.getKeyInfo() : null;
+        if (keyInfo != null) {
+            return new KeyInfoCredentialContext(keyInfo);
         }
         return null;
     }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java
index 719187de5..68347a8a1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/AgreementMethodKeyInfoProvider.java
@@ -26,6 +26,7 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialContext;
+import org.opensaml.security.credential.CredentialContextSet;
 import org.opensaml.xmlsec.agreement.KeyAgreementCredential;
 import org.opensaml.xmlsec.agreement.KeyAgreementException;
 import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
@@ -36,6 +37,7 @@ import org.opensaml.xmlsec.agreement.impl.KeyAgreementParametersParser;
 import org.opensaml.xmlsec.agreement.impl.PrivateCredential;
 import org.opensaml.xmlsec.encryption.AgreementMethod;
 import org.opensaml.xmlsec.encryption.EncryptedType;
+import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.OriginatorKeyInfo;
 import org.opensaml.xmlsec.encryption.RecipientKeyInfo;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolutionMode;
@@ -44,9 +46,9 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.collection.LazySet;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -56,10 +58,10 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(AgreementMethodKeyInfoProvider.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(AgreementMethodKeyInfoProvider.class);
     
     /** Parser for AgreementMethod parameters. */
-    private final KeyAgreementParametersParser parametersParser = new KeyAgreementParametersParser();
+    @Nonnull private final KeyAgreementParametersParser parametersParser = new KeyAgreementParametersParser();
 
     /** {@inheritDoc} */
     public boolean handles(@Nonnull final XMLObject keyInfoChild) {
@@ -80,8 +82,8 @@ public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
             return false;
         }
         
-        if (agreementMethod.getParent() == null || agreementMethod.getParent().getParent() == null
-                || !EncryptedType.class.isInstance(agreementMethod.getParent().getParent())) {
+        final XMLObject parent = agreementMethod.getParent();
+        if (parent == null || parent.getParent() == null || !EncryptedType.class.isInstance(parent.getParent())) {
             log.debug("AgreementMethod is not the grandchild of an EncryptedType element");
             return false;
         }
@@ -100,8 +102,13 @@ public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
         }
         
         final AgreementMethod agreementMethod = AgreementMethod.class.cast(keyInfoChild);
-        final KeyAgreementProcessor processor =
-                KeyAgreementSupport.getGlobalProcessorRegistry().getProcessor(agreementMethod.getAlgorithm());
+        final String agreementAlg = agreementMethod.getAlgorithm();
+        
+        final KeyAgreementProcessor processor = agreementAlg != null
+                ? KeyAgreementSupport.ensureGlobalProcessorRegistry().getProcessor(agreementAlg) : null;
+        if (processor == null) {
+            throw new SecurityException("No KeyAgreementProcessor returned from registry");
+        }
         
         log.debug("Attempting to process key agreemenent for algorithm: {}", processor.getAlgorithm());
         
@@ -126,7 +133,10 @@ public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
 
         final CredentialContext credContext = buildCredentialContext(kiContext);
         if (credContext != null) {
-            cred.getCredentialContextSet().add(credContext);
+            final CredentialContextSet ctxset = cred.getCredentialContextSet();
+            if (ctxset != null) {
+                ctxset.add(credContext);
+            }
         }
 
         log.debug("Credential successfully produced by AgreementMethod with algorithm: {}", cred.getAlgorithm());
@@ -150,15 +160,23 @@ public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
      */
     @Nonnull private String resolveKeyAlgorithm(@Nonnull final AgreementMethod agreementMethod)
             throws SecurityException {
-        
+
         // This was already validated in handles(...)
-        final EncryptedType encrytpedType = EncryptedType.class.cast(agreementMethod.getParent().getParent());
+        final XMLObject parent = agreementMethod.getParent();
+        assert parent != null;
+        final EncryptedType encrytpedType = EncryptedType.class.cast(parent.getParent());
+        
+        final EncryptionMethod method = encrytpedType.getEncryptionMethod();
+        if (method == null) {
+            throw new SecurityException("EncryptionMethod is missing");
+        }
         
-        if (encrytpedType.getEncryptionMethod() == null || encrytpedType.getEncryptionMethod().getAlgorithm() == null) {
+        final String alg = method.getAlgorithm();
+        if (alg == null) {
             throw new SecurityException("EncryptedType contains no EncryptionMethod algorithm");
         }
         
-        return encrytpedType.getEncryptionMethod().getAlgorithm();
+        return alg;
     }
 
     /**
@@ -233,4 +251,4 @@ public class AgreementMethodKeyInfoProvider extends AbstractKeyInfoProvider {
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java
index c0cd3d530..4c934630f 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/DEREncodedKeyValueProvider.java
@@ -25,6 +25,7 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.collection.LazySet;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 import org.opensaml.core.xml.XMLObject;
@@ -38,7 +39,6 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
 import org.opensaml.xmlsec.signature.DEREncodedKeyValue;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Implementation of {@link org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider} which supports {@link DEREncodedKeyValue}.
@@ -46,7 +46,7 @@ import org.slf4j.LoggerFactory;
 public class DEREncodedKeyValueProvider extends AbstractKeyInfoProvider {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(DEREncodedKeyValueProvider.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(DEREncodedKeyValueProvider.class);
 
     /** {@inheritDoc} */
     public boolean handles(@Nonnull final XMLObject keyInfoChild) {
@@ -73,7 +73,8 @@ public class DEREncodedKeyValueProvider extends AbstractKeyInfoProvider {
             throw new SecurityException("Error extracting DER-encoded key value", e);
         }
         
-        final KeyAlgorithmCriterion algorithmCriteria = criteriaSet.get(KeyAlgorithmCriterion.class);
+        final KeyAlgorithmCriterion algorithmCriteria =
+                criteriaSet != null ? criteriaSet.get(KeyAlgorithmCriterion.class) : null;
         if (algorithmCriteria != null && algorithmCriteria.getKeyAlgorithm() != null
                 && !algorithmCriteria.getKeyAlgorithm().equals(pubKey.getAlgorithm())) {
             log.debug("Criteria specified key algorithm {}, actually {}, skipping",
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java
index c47d059fe..123a38f0c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/InlineX509DataProvider.java
@@ -35,6 +35,7 @@ import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 import org.opensaml.core.xml.XMLObject;
@@ -51,11 +52,12 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
 import org.opensaml.xmlsec.signature.X509Data;
 import org.opensaml.xmlsec.signature.X509Digest;
+import org.opensaml.xmlsec.signature.X509IssuerName;
 import org.opensaml.xmlsec.signature.X509IssuerSerial;
 import org.opensaml.xmlsec.signature.X509SKI;
+import org.opensaml.xmlsec.signature.X509SerialNumber;
 import org.opensaml.xmlsec.signature.X509SubjectName;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
@@ -75,10 +77,10 @@ import com.google.common.base.Strings;
 public class InlineX509DataProvider extends AbstractKeyInfoProvider {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(InlineX509DataProvider.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(InlineX509DataProvider.class);
 
     /** Responsible for parsing and serializing X.500 names to/from {@link X500Principal} instances. */
-    private X500DNHandler x500DNHandler;
+    @Nonnull private X500DNHandler x500DNHandler;
 
     /**
      * Constructor.
@@ -289,11 +291,14 @@ public class InlineX509DataProvider extends AbstractKeyInfoProvider {
      */
     @Nullable protected X509Certificate findCertFromSubjectNames(@Nonnull final List<X509Certificate> certs,
             @Nonnull final List<X509SubjectName> names) {
+        
         for (final X509SubjectName subjectName : names) {
-            if (!Strings.isNullOrEmpty(subjectName.getValue())) {
+            final String subjectNameVal = subjectName.getValue();
+            if (!Strings.isNullOrEmpty(subjectNameVal)) {
                 X500Principal subjectX500Principal = null;
                 try {
-                    subjectX500Principal = x500DNHandler.parse(subjectName.getValue());
+                    assert subjectNameVal != null;
+                    subjectX500Principal = x500DNHandler.parse(subjectNameVal);
                 } catch (final IllegalArgumentException e) {
                     log.warn("X500 subject name '{}' could not be parsed by configured X500DNHandler '{}'",
                             subjectName.getValue(), x500DNHandler.getClass().getName());
@@ -319,14 +324,20 @@ public class InlineX509DataProvider extends AbstractKeyInfoProvider {
     @Nullable protected X509Certificate findCertFromIssuerSerials(@Nonnull final List<X509Certificate> certs,
             @Nonnull final List<X509IssuerSerial> serials) {
         for (final X509IssuerSerial issuerSerial : serials) {
-            if (issuerSerial.getX509IssuerName() == null || issuerSerial.getX509SerialNumber() == null) {
+            
+            final X509IssuerName issuerNameObj = issuerSerial.getX509IssuerName();
+            final X509SerialNumber serialNumObj = issuerSerial.getX509SerialNumber();
+            
+            if (issuerNameObj == null || serialNumObj == null) {
                 continue;
             }
-            final String issuerNameValue = issuerSerial.getX509IssuerName().getValue();
-            final BigInteger serialNumber = issuerSerial.getX509SerialNumber().getValue();
+            
+            final String issuerNameValue = issuerNameObj.getValue();
+            final BigInteger serialNumber = serialNumObj.getValue();
             if (!Strings.isNullOrEmpty(issuerNameValue)) {
                 X500Principal issuerX500Principal = null;
                 try {
+                    assert issuerNameValue != null;
                     issuerX500Principal = x500DNHandler.parse(issuerNameValue);
                 } catch (final IllegalArgumentException e) {
                     log.warn("X500 issuer name '{}' could not be parsed by configured X500DNHandler '{}'",
@@ -354,13 +365,16 @@ public class InlineX509DataProvider extends AbstractKeyInfoProvider {
     @Nullable protected X509Certificate findCertFromSubjectKeyIdentifier(@Nonnull final List<X509Certificate> certs,
             @Nonnull final List<X509SKI> skis) {
         for (final X509SKI ski : skis) {
-            if (!Strings.isNullOrEmpty(ski.getValue())) {
-                final byte[] xmlValue = base64DecodeOrNull(ski.getValue());
+            final String skiValue = ski.getValue();
+            if (!Strings.isNullOrEmpty(skiValue)) {
+                assert skiValue != null;
+                final byte[] xmlValue = base64DecodeOrNull(skiValue);
                 if (xmlValue==null) {
                     log.warn("Could not base64 decode subject key identifier value, skipping");
                     continue;
                 }
                 for (final X509Certificate cert : certs) {
+                    assert cert != null;
                     final byte[] certValue = X509Support.getSubjectKeyIdentifier(cert);
                     if (certValue != null && Arrays.equals(xmlValue, certValue)) {
                         return cert;
@@ -398,18 +412,23 @@ public class InlineX509DataProvider extends AbstractKeyInfoProvider {
             @Nonnull final List<X509Digest> digests) {
         
         for (final X509Digest digest : digests) {
-            if (!Strings.isNullOrEmpty(digest.getValue()) && !Strings.isNullOrEmpty(digest.getAlgorithm())) {
-                final String alg = AlgorithmSupport.getAlgorithmID(digest.getAlgorithm());
+            final String digestVal = digest.getValue();
+            final String digestAlg = digest.getAlgorithm();
+            if (!Strings.isNullOrEmpty(digestVal) && !Strings.isNullOrEmpty(digestAlg)) {
+                assert digestVal != null;
+                assert digestAlg != null;
+                final String alg = AlgorithmSupport.getAlgorithmID(digestAlg);
                 if (alg == null) {
-                    log.warn("Algorithm {} not supported", digest.getAlgorithm());
+                    log.warn("Algorithm {} not supported", digestAlg);
                     continue;
                 }
-                final byte[] xmlValue = base64DecodeOrNull(digest.getValue());
+                final byte[] xmlValue = base64DecodeOrNull(digestVal);
                 if (xmlValue==null) {
                     log.warn("Could not base64 decode digest, skipping");
                     continue;
                 }
                 for (final X509Certificate cert : certs) {
+                    assert cert != null;
                     try {
                         final byte[] certValue = X509Support.getX509Digest(cert, alg);
                         if (certValue != null && Arrays.equals(xmlValue, certValue)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java
index 93121d75c..b8c94902d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/KeyInfoReferenceProvider.java
@@ -32,8 +32,8 @@ import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.KeyInfoReference;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.Criterion;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -47,26 +47,28 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class KeyInfoReferenceProvider extends AbstractKeyInfoProvider {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(KeyInfoReferenceProvider.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(KeyInfoReferenceProvider.class);
 
     /** {@inheritDoc} */
     public boolean handles(@Nonnull final XMLObject keyInfoChild) {
         return getKeyInfoReference(keyInfoChild) != null;
     }
 
+// Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
     @Nullable public Collection<Credential> process(@Nonnull final KeyInfoCredentialResolver resolver,
             @Nonnull final XMLObject keyInfoChild, @Nullable final CriteriaSet criteriaSet,
             @Nonnull final KeyInfoResolutionContext kiContext) throws SecurityException {
 
         final KeyInfoReference ref = getKeyInfoReference(keyInfoChild);
-        if (ref == null) {
+        final String refURI = ref != null ? ref.getURI() : null;
+        if (ref == null || refURI == null) {
             return null;
         }
-
+        
         log.debug("Attempting to follow same-document KeyInfoReference");
 
-        final XMLObject target = ref.resolveIDFromRoot(ref.getURI().substring(1));
+        final XMLObject target = ref.resolveIDFromRoot(refURI.substring(1));
         if (target == null) {
             log.warn("KeyInfoReference URI could not be dereferenced");
             return null;
@@ -83,9 +85,11 @@ public class KeyInfoReferenceProvider extends AbstractKeyInfoProvider {
         // Copy the existing CriteriaSet, excluding the KeyInfoCriteria, which is reset to the target.
         final CriteriaSet newCriteria = new CriteriaSet();
         newCriteria.add(new KeyInfoCriterion((KeyInfo) target));
-        for (final Criterion crit : criteriaSet) {
-            if (!(crit instanceof KeyInfoCriterion)) {
-                newCriteria.add(crit);
+        if (criteriaSet != null) {
+            for (final Criterion crit : criteriaSet) {
+                if (!(crit instanceof KeyInfoCriterion)) {
+                    newCriteria.add(crit);
+                }
             }
         }
         
@@ -105,7 +109,8 @@ public class KeyInfoReferenceProvider extends AbstractKeyInfoProvider {
         
         return null;
     }
-
+// Checkstyle: CyclomaticComplexity ON
+    
     /**
      * Get the KeyInfoReference from the passed XML object.
      * 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java
index c2d07a75a..6cd4f59de 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/keyinfo/impl/provider/RSAKeyValueProvider.java
@@ -25,6 +25,7 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.collection.LazySet;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 import org.opensaml.core.xml.XMLObject;
@@ -39,7 +40,6 @@ import org.opensaml.xmlsec.keyinfo.impl.KeyInfoResolutionContext;
 import org.opensaml.xmlsec.signature.KeyValue;
 import org.opensaml.xmlsec.signature.RSAKeyValue;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Implementation of {@link org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider} which supports {@link RSAKeyValue}.
@@ -47,7 +47,7 @@ import org.slf4j.LoggerFactory;
 public class RSAKeyValueProvider extends AbstractKeyInfoProvider {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(RSAKeyValueProvider.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(RSAKeyValueProvider.class);
 
     /** {@inheritDoc} */
     public boolean handles(@Nonnull final XMLObject keyInfoChild) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
index 7d44482a3..609d141c1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
@@ -34,11 +34,11 @@ import org.opensaml.xmlsec.SignatureValidationParametersResolver;
 import org.opensaml.xmlsec.context.SecurityParametersContext;
 import org.opensaml.xmlsec.criterion.SignatureValidationConfigurationCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
index 7db42bc84..69a67a7f8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
@@ -21,6 +21,7 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -36,7 +37,6 @@ import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 import org.opensaml.xmlsec.signature.support.SignatureValidationParametersCriterion;
 import org.opensaml.xmlsec.signature.support.SignatureValidator;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
@@ -62,10 +62,10 @@ import com.google.common.base.Strings;
 public abstract class BaseSignatureTrustEngine<TrustBasisType> implements SignatureTrustEngine {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(BaseSignatureTrustEngine.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(BaseSignatureTrustEngine.class);
 
     /** KeyInfo credential resolver used to obtain the signing credential from a Signature's KeyInfo. */
-    private final KeyInfoCredentialResolver keyInfoCredentialResolver;
+    @Nonnull private final KeyInfoCredentialResolver keyInfoCredentialResolver;
 
     /**
      * Constructor.
@@ -78,7 +78,7 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
     }
 
     /** {@inheritDoc} */
-    @Nullable public KeyInfoCredentialResolver getKeyInfoResolver() {
+    @Nonnull public KeyInfoCredentialResolver getKeyInfoResolver() {
         return keyInfoCredentialResolver;
     }
     
@@ -87,6 +87,7 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
             throws SecurityException {
         
         checkParams(signature, trustBasisCriteria);
+        assert trustBasisCriteria != null;
         
         final SignatureValidationParametersCriterion validationCriterion = 
                 trustBasisCriteria.get(SignatureValidationParametersCriterion.class);
@@ -124,6 +125,7 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
             @Nullable final Credential candidateCredential) throws SecurityException {
         
         checkParamsRaw(signature, content, algorithmURI, trustBasisCriteria);
+        assert trustBasisCriteria != null;
         
         final SignatureValidationParametersCriterion validationCriterion = 
                 trustBasisCriteria.get(SignatureValidationParametersCriterion.class);
@@ -195,6 +197,7 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
 
             try {
                 for (final Credential kiCred : getKeyInfoResolver().resolve(keyInfoCriteriaSet)) {
+                    assert kiCred != null;
                     if (verifySignature(signature, kiCred)) {
                         log.debug("Successfully verified signature using KeyInfo-derived credential");
                         log.debug("Attempting to establish trust of KeyInfo-derived credential");
@@ -255,12 +258,10 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
      * @param trustBasisCriteria the set of trusted credential criteria
      * @throws SecurityException thrown if required values are absent or otherwise invalid
      */
-    protected void checkParams(@Nonnull final Signature signature, @Nonnull final CriteriaSet trustBasisCriteria)
+    protected void checkParams(@Nonnull final Signature signature, @Nullable final CriteriaSet trustBasisCriteria)
             throws SecurityException {
 
-        if (signature == null) {
-            throw new SecurityException("Signature cannot be null");
-        } else if (trustBasisCriteria == null) {
+        if (trustBasisCriteria == null) {
             throw new SecurityException("Trust basis criteria set cannot be null");
         } else if (trustBasisCriteria.isEmpty()) {
             throw new SecurityException("Trust basis criteria set cannot be empty");
@@ -277,7 +278,7 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
      * @throws SecurityException thrown if required values are absent or otherwise invalid
      */
     protected void checkParamsRaw(@Nonnull final byte[] signature, @Nonnull final byte[] content,
-            @Nonnull final String algorithmURI, @Nonnull final CriteriaSet trustBasisCriteria)
+            @Nonnull final String algorithmURI, @Nullable final CriteriaSet trustBasisCriteria)
             throws SecurityException {
 
         if (signature == null || signature.length == 0) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java
index 4dec99f90..6ddea5558 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignaturePrevalidator.java
@@ -23,13 +23,14 @@ import javax.annotation.Nonnull;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignaturePrevalidator;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * A signature prevalidator implementation which chains execution of a list of {@link SignaturePrevalidator} instances.
@@ -47,9 +48,10 @@ public class ChainingSignaturePrevalidator implements SignaturePrevalidator {
      *
      * @param validatorChain the chain of SignaturePrevalidator instances to execute
      */
-    public ChainingSignaturePrevalidator(@Nonnull @NonnullElements @ParameterName(name="validatorChain") 
-                                                      final List<SignaturePrevalidator> validatorChain) {
-        validators = List.copyOf(Constraint.isNotNull(validatorChain, "SignaturePrevalidator list cannot be null"));
+    public ChainingSignaturePrevalidator(
+            @Nonnull @ParameterName(name="validatorChain") final List<SignaturePrevalidator> validatorChain) {
+        validators = CollectionSupport.copyToList(
+                Constraint.isNotNull(validatorChain, "SignaturePrevalidator list cannot be null"));
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngine.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngine.java
index 331ecdfa1..57c9f76d1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngine.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngine.java
@@ -23,10 +23,11 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 import org.opensaml.security.SecurityException;
@@ -35,7 +36,6 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Evaluate a signature in sequence using a chain of subordinate trust engines. If the signature may be established as
@@ -47,16 +47,15 @@ public class ChainingSignatureTrustEngine implements SignatureTrustEngine {
     @Nonnull private final Logger log = LoggerFactory.getLogger(ChainingSignatureTrustEngine.class);
 
     /** The chain of subordinate trust engines. */
-    @Nonnull @NonnullElements private List<SignatureTrustEngine> engines;
+    @Nonnull private List<SignatureTrustEngine> engines;
 
     /**
      *  Constructor. 
      *  
      *  @param chain the list of trust engines in the chain
      */
-    public ChainingSignatureTrustEngine(
-            @Nonnull @NonnullElements @ParameterName(name="chain") final List<SignatureTrustEngine> chain) {
-        engines = List.copyOf(Constraint.isNotNull(chain, "SignatureTrustEngine list cannot be null"));
+    public ChainingSignatureTrustEngine(@Nonnull @ParameterName(name="chain") final List<SignatureTrustEngine> chain) {
+        engines = CollectionSupport.copyToList(Constraint.isNotNull(chain, "SignatureTrustEngine list cannot be null"));
     }
 
     /**
@@ -64,19 +63,17 @@ public class ChainingSignatureTrustEngine implements SignatureTrustEngine {
      * 
      * @return the modifiable list of trust engines in the chain
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<SignatureTrustEngine> getChain() {
+    @Nonnull @Unmodifiable @NotLive public List<SignatureTrustEngine> getChain() {
         return engines;
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public KeyInfoCredentialResolver getKeyInfoResolver() {
         // Chaining signature trust engine does not support an attached KeyInfoResolver
         return null;
     }
 
     /** {@inheritDoc} */
-    @Override
     public boolean validate(@Nonnull final Signature token, @Nullable final CriteriaSet trustBasisCriteria)
             throws SecurityException {
         
@@ -90,10 +87,9 @@ public class ChainingSignatureTrustEngine implements SignatureTrustEngine {
     }
 
     /** {@inheritDoc} */
-    @Override
     public boolean validate(@Nonnull final byte[] signature, @Nonnull final byte[] content,
             @Nonnull final String algorithmURI, @Nullable final CriteriaSet trustBasisCriteria,
-            @Nonnull final Credential candidateCredential) throws SecurityException {
+            @Nullable final Credential candidateCredential) throws SecurityException {
         
         for (final SignatureTrustEngine engine : engines) {
             if (engine.validate(signature, content, algorithmURI, trustBasisCriteria, candidateCredential)) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java
index 7d717201e..5b076365e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java
@@ -22,6 +22,7 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -38,7 +39,6 @@ import org.opensaml.xmlsec.crypto.XMLSigningUtil;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.signature.Signature;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
@@ -57,13 +57,13 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
         TrustedCredentialTrustEngine<Signature> {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ExplicitKeySignatureTrustEngine.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeySignatureTrustEngine.class);
 
     /** Resolver used for resolving trusted credentials. */
-    private final CredentialResolver credentialResolver;
+    @Nonnull private final CredentialResolver credentialResolver;
 
     /** The external explicit key trust engine to use as a basis for trust in this implementation. */
-    private final ExplicitKeyTrustEvaluator keyTrust;
+    @Nonnull private final ExplicitKeyTrustEvaluator keyTrust;
 
     /**
      * Constructor.
@@ -81,7 +81,7 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull public CredentialResolver getCredentialResolver() {
+    @Nonnull public CredentialResolver getCredentialResolver() {
         return credentialResolver;
     }
 
@@ -94,8 +94,11 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
         if (!criteriaSet.contains(UsageCriterion.class)) {
             criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
         }
-        final String jcaAlgorithm = AlgorithmSupport.getKeyAlgorithm(signature.getSignatureAlgorithm());
+        
+        final String signatureAlg = signature.getSignatureAlgorithm();
+        final String jcaAlgorithm = signatureAlg != null ? AlgorithmSupport.getKeyAlgorithm(signatureAlg) : null;
         if (!Strings.isNullOrEmpty(jcaAlgorithm)) {
+            assert jcaAlgorithm != null;
             criteriaSet.add(new KeyAlgorithmCriterion(jcaAlgorithm), true);
         }
 
@@ -116,6 +119,7 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
         log.debug("Attempting to verify signature using trusted credentials");
 
         for (final Credential trustedCredential : trustedCredentials) {
+            assert trustedCredential != null;
             if (verifySignature(signature, trustedCredential)) {
                 log.debug("Successfully verified signature using resolved trusted credential");
                 return true;
@@ -138,6 +142,7 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
         }
         final String jcaAlgorithm = AlgorithmSupport.getKeyAlgorithm(algorithmURI);
         if (!Strings.isNullOrEmpty(jcaAlgorithm)) {
+            assert jcaAlgorithm != null;
             criteriaSet.add(new KeyAlgorithmCriterion(jcaAlgorithm), true);
         }
 
@@ -173,6 +178,7 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
         log.debug("Attempting to verify signature using trusted credentials");
 
         for (final Credential trustedCredential : trustedCredentials) {
+            assert trustedCredential != null;
             try {
                 if (XMLSigningUtil.verifyWithURI(trustedCredential, algorithmURI, signature, content)) {
                     log.debug("Successfully verified signature using resolved trusted credential");
@@ -194,6 +200,12 @@ public class ExplicitKeySignatureTrustEngine extends BaseSignatureTrustEngine<It
     @Override protected boolean evaluateTrust(@Nonnull final Credential untrustedCredential,
             @Nullable final Iterable<Credential> trustedCredentials) throws SecurityException {
 
+        if (trustedCredentials == null) {
+            log.debug("No trusted credential supplied");
+            return false;
+        }
+        
         return keyTrust.validate(untrustedCredential, trustedCredentials);
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java
index 8fc1cdd8e..40d814597 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -43,7 +44,6 @@ import org.opensaml.xmlsec.crypto.XMLSigningUtil;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.signature.Signature;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * An implementation of {@link org.opensaml.xmlsec.signature.support.SignatureTrustEngine} which evaluates the validity
@@ -62,16 +62,16 @@ public class PKIXSignatureTrustEngine extends
         PKIXTrustEngine<Signature> {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(PKIXSignatureTrustEngine.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(PKIXSignatureTrustEngine.class);
 
     /** Resolver used for resolving trusted credentials. */
-    private final PKIXValidationInformationResolver pkixResolver;
+    @Nonnull private final PKIXValidationInformationResolver pkixResolver;
 
     /** The external PKIX trust evaluator used to establish trust. */
-    private final PKIXTrustEvaluator pkixTrustEvaluator;
+    @Nonnull private final PKIXTrustEvaluator pkixTrustEvaluator;
 
     /** The external credential name evaluator used to establish trusted name compliance. */
-    private final X509CredentialNameEvaluator credNameEvaluator;
+    @Nullable private final X509CredentialNameEvaluator credNameEvaluator;
 
     /**
      * Constructor.
@@ -214,6 +214,11 @@ public class PKIXSignatureTrustEngine extends
         }
         final X509Credential untrustedX509Credential = (X509Credential) untrustedCredential;
 
+        if (validationPair == null) {
+            log.debug("PKIX validation information not available. Aborting PKIX validation");
+            return false;
+        }
+        
         final Set<String> trustedNames = validationPair.getFirst();
         final Iterable<PKIXValidationInformation> validationInfoSet = validationPair.getSecond();
         if (validationInfoSet == null) {
@@ -227,6 +232,7 @@ public class PKIXSignatureTrustEngine extends
         }
 
         for (final PKIXValidationInformation validationInfo : validationInfoSet) {
+            assert validationInfo != null;
             try {
                 if (pkixTrustEvaluator.validate(validationInfo, untrustedX509Credential)) {
                     log.debug("Signature trust established via PKIX validation of signing credential");
@@ -299,6 +305,7 @@ public class PKIXSignatureTrustEngine extends
                     + "skipping trusted name evaluation");
            return true; 
         } else {
+            assert credNameEvaluator != null;
             return credNameEvaluator.evaluate(untrustedCredential, trustedNames);
         }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java
index 0d8467d8e..f7432161c 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java
@@ -28,6 +28,7 @@ import javax.xml.namespace.QName;
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
@@ -38,7 +39,6 @@ import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.w3c.dom.Element;
 
 /**
@@ -76,10 +76,10 @@ public class SignatureAlgorithmValidator {
     @Nonnull private Logger log = LoggerFactory.getLogger(SignatureAlgorithmValidator.class);
     
     /** The collection of algorithm URIs which are included. */
-    private Collection<String> includedAlgorithmURIs;
+    @Nullable private Collection<String> includedAlgorithmURIs;
     
     /** The collection of algorithm URIs which are excluded. */
-    private Collection<String> excludedAlgorithmURIs;
+    @Nullable private Collection<String> excludedAlgorithmURIs;
     
     /**
      * Constructor.
@@ -123,6 +123,7 @@ public class SignatureAlgorithmValidator {
         validateAlgorithmURI(signatureAlgorithm);
         
         for (final String digestMethod : getDigestMethods(signature)) {
+            assert digestMethod != null;
             log.debug("Validating SignedInfo/Reference/DigestMethod/@Algorithm against include/exclude lists: {}", 
                     digestMethod);
             validateAlgorithmURI(digestMethod);
@@ -197,6 +198,7 @@ public class SignatureAlgorithmValidator {
         }
         
         for (final Element reference : ElementSupport.getChildElements(signedInfo, ELEMENT_NAME_REFERENCE)) {
+            assert reference != null;
             final Element digestMethod = ElementSupport.getFirstChildElement(reference, ELEMENT_NAME_DIGEST_METHOD);
             if (digestMethod != null) {
                 final String digestMethodAlgorithm = StringSupport.trimOrNull(
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java
index 212e1ae87..1045c05ca 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/provider/ApacheSantuarioSignerProviderImpl.java
@@ -22,6 +22,7 @@ import javax.annotation.Nonnull;
 import org.apache.xml.security.Init;
 import org.apache.xml.security.exceptions.XMLSecurityException;
 import org.apache.xml.security.signature.XMLSignature;
+import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.impl.SignatureImpl;
@@ -55,8 +56,15 @@ public class ApacheSantuarioSignerProviderImpl implements SignerProvider {
                 throw new SignatureException(
                         "XMLObject does not have XMLSignature instance, unable to compute signature");
             }
+            
+            final Credential signingCred = signature.getSigningCredential();
+            if (signingCred == null) {
+                log.error("Unable to compute signature, Signature XMLObject does not contain a signing key");
+                throw new SignatureException("XMLObject does not have signing key, unable to compute signature");
+            }
+            
             log.debug("Computing signature over XMLSignature object");
-            xmlSignature.sign(CredentialSupport.extractSigningKey(signature.getSigningCredential()));
+            xmlSignature.sign(CredentialSupport.extractSigningKey(signingCred));
         } catch (final XMLSecurityException e) {
             log.error("An error occured computing the digital signature: {}", e.getMessage());
             throw new SignatureException("Signature computation error", e);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessorTest.java
index 9e0ed3648..a12fa3bef 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithExplicitKDFKeyAgreementProcessorTest.java
@@ -21,6 +21,8 @@ import java.security.KeyPair;
 import java.util.ArrayList;
 import java.util.Collection;
 
+import javax.crypto.SecretKey;
+
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
@@ -36,9 +38,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DHWithExplicitKDFKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
     
     private DHWithExplicitKDFKeyAgreementProcessor processor;
@@ -63,9 +63,10 @@ public class DHWithExplicitKDFKeyAgreementProcessorTest extends OpenSAMLInitBase
         
         Assert.assertNotNull(keyAgreementCredential);
         
-        Assert.assertNotNull(keyAgreementCredential.getSecretKey());
-        Assert.assertEquals(keyAgreementCredential.getSecretKey().getAlgorithm(), JCAConstants.KEY_ALGO_AES);
-        Assert.assertEquals(KeySupport.getKeyLength(keyAgreementCredential.getSecretKey()), Integer.valueOf(128));
+        final SecretKey skey = keyAgreementCredential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), JCAConstants.KEY_ALGO_AES);
+        Assert.assertEquals(KeySupport.getKeyLength(skey), Integer.valueOf(128));
         
         Assert.assertNull(keyAgreementCredential.getPublicKey());
         Assert.assertNull(keyAgreementCredential.getPrivateKey());
@@ -84,8 +85,10 @@ public class DHWithExplicitKDFKeyAgreementProcessorTest extends OpenSAMLInitBase
         
         Assert.assertEquals(keyAgreementCredential.getParameters().size(), 2);
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(MockKeyDerivation.class));
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(KANonce.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(KANonce.class).getValue(), "AABBCCDD");
+        
+        final KANonce nonce = keyAgreementCredential.getParameters().get(KANonce.class);
+        assert nonce != null;
+        Assert.assertEquals(nonce.getValue(), "AABBCCDD");
         
     }
     
@@ -108,9 +111,10 @@ public class DHWithExplicitKDFKeyAgreementProcessorTest extends OpenSAMLInitBase
         
         Assert.assertNotNull(keyAgreementCredential);
         
-        Assert.assertNotNull(keyAgreementCredential.getSecretKey());
-        Assert.assertEquals(keyAgreementCredential.getSecretKey().getAlgorithm(), JCAConstants.KEY_ALGO_AES);
-        Assert.assertEquals(KeySupport.getKeyLength(keyAgreementCredential.getSecretKey()), Integer.valueOf(128));
+        final SecretKey skey = keyAgreementCredential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), JCAConstants.KEY_ALGO_AES);
+        Assert.assertEquals(KeySupport.getKeyLength(skey), Integer.valueOf(128));
         
         Assert.assertNull(keyAgreementCredential.getPublicKey());
         Assert.assertNull(keyAgreementCredential.getPrivateKey());
@@ -130,9 +134,9 @@ public class DHWithExplicitKDFKeyAgreementProcessorTest extends OpenSAMLInitBase
         Assert.assertEquals(keyAgreementCredential.getParameters().size(), 3);
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(PrivateCredential.class));
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(MockKeyDerivation.class));
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(KANonce.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(KANonce.class).getValue(), "AABBCCDD");
-        
+        final KANonce nonce = keyAgreementCredential.getParameters().get(KANonce.class);
+        assert nonce != null;
+        Assert.assertEquals(nonce.getValue(), "AABBCCDD");
     }
 
     @Test(expectedExceptions = KeyAgreementException.class)
@@ -197,6 +201,5 @@ public class DHWithExplicitKDFKeyAgreementProcessorTest extends OpenSAMLInitBase
         params.add(nonce);
         return params;
     }
-    
-        
-}
+            
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessorTest.java
index 6dd82b3c7..fcf8fe233 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DHWithLegacyKDFKeyAgreementProcessorTest.java
@@ -18,8 +18,8 @@
 package org.opensaml.xmlsec.agreement.impl;
 
 import java.security.KeyPair;
-import java.util.ArrayList;
-import java.util.Collection;
+
+import javax.crypto.SecretKey;
 
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.security.credential.Credential;
@@ -28,18 +28,14 @@ import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.agreement.KeyAgreementCredential;
 import org.opensaml.xmlsec.agreement.KeyAgreementException;
-import org.opensaml.xmlsec.agreement.KeyAgreementParameter;
 import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
-import org.opensaml.xmlsec.derivation.impl.MockKeyDerivation;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DHWithLegacyKDFKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
     
     private DHWithLegacyKDFKeyAgreementProcessor processor;
@@ -70,9 +66,10 @@ public class DHWithLegacyKDFKeyAgreementProcessorTest extends OpenSAMLInitBaseTe
         
         Assert.assertNotNull(keyAgreementCredential);
         
-        Assert.assertNotNull(keyAgreementCredential.getSecretKey());
-        Assert.assertEquals(keyAgreementCredential.getSecretKey().getAlgorithm(), JCAConstants.KEY_ALGO_AES);
-        Assert.assertEquals(KeySupport.getKeyLength(keyAgreementCredential.getSecretKey()), Integer.valueOf(128));
+        final SecretKey skey = keyAgreementCredential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), JCAConstants.KEY_ALGO_AES);
+        Assert.assertEquals(KeySupport.getKeyLength(skey), Integer.valueOf(128));
         
         Assert.assertNull(keyAgreementCredential.getPublicKey());
         Assert.assertNull(keyAgreementCredential.getPrivateKey());
@@ -90,10 +87,14 @@ public class DHWithLegacyKDFKeyAgreementProcessorTest extends OpenSAMLInitBaseTe
         Assert.assertEquals(keyAgreementCredential.getAlgorithm(), EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH);
         
         Assert.assertEquals(keyAgreementCredential.getParameters().size(), 2);
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(DigestMethod.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(DigestMethod.class).getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(KANonce.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(KANonce.class).getValue(), "AABBCCDD");
+        
+        final DigestMethod method = keyAgreementCredential.getParameters().get(DigestMethod.class); 
+        assert method != null;
+        Assert.assertEquals(method.getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+     
+        final KANonce kanonce = keyAgreementCredential.getParameters().get(KANonce.class);
+        assert kanonce != null;
+        Assert.assertEquals(kanonce.getValue(), "AABBCCDD");
     }
     
     @Test
@@ -121,9 +122,10 @@ public class DHWithLegacyKDFKeyAgreementProcessorTest extends OpenSAMLInitBaseTe
         
         Assert.assertNotNull(keyAgreementCredential);
         
-        Assert.assertNotNull(keyAgreementCredential.getSecretKey());
-        Assert.assertEquals(keyAgreementCredential.getSecretKey().getAlgorithm(), JCAConstants.KEY_ALGO_AES);
-        Assert.assertEquals(KeySupport.getKeyLength(keyAgreementCredential.getSecretKey()), Integer.valueOf(128));
+        final SecretKey skey = keyAgreementCredential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), JCAConstants.KEY_ALGO_AES);
+        Assert.assertEquals(KeySupport.getKeyLength(skey), Integer.valueOf(128));
         
         Assert.assertNull(keyAgreementCredential.getPublicKey());
         Assert.assertNull(keyAgreementCredential.getPrivateKey());
@@ -142,10 +144,13 @@ public class DHWithLegacyKDFKeyAgreementProcessorTest extends OpenSAMLInitBaseTe
         
         Assert.assertEquals(keyAgreementCredential.getParameters().size(), 3);
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(PrivateCredential.class));
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(DigestMethod.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(DigestMethod.class).getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(KANonce.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(KANonce.class).getValue(), "AABBCCDD");
+
+        final DigestMethod method = keyAgreementCredential.getParameters().get(DigestMethod.class); 
+        assert method != null;
+        Assert.assertEquals(method.getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+        final KANonce kanonce = keyAgreementCredential.getParameters().get(KANonce.class);
+        assert kanonce != null;
+        Assert.assertEquals(kanonce.getValue(), "AABBCCDD");
         
     }
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DigestMethodTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DigestMethodTest.java
index fa5d15f92..5df3e79d4 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DigestMethodTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/DigestMethodTest.java
@@ -26,9 +26,7 @@ import org.testng.annotations.Test;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.component.UnmodifiableComponentException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DigestMethodTest extends XMLObjectBaseTestCase {
     
     @Test
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java
index af74f296e..8e0e712a6 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java
@@ -22,6 +22,8 @@ import java.security.spec.ECGenParameterSpec;
 import java.util.ArrayList;
 import java.util.Collection;
 
+import javax.crypto.SecretKey;
+
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
@@ -37,9 +39,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class ECDHKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
     
     private ECDHKeyAgreementProcessor processor;
@@ -64,9 +64,10 @@ public class ECDHKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
         
         Assert.assertNotNull(keyAgreementCredential);
         
-        Assert.assertNotNull(keyAgreementCredential.getSecretKey());
-        Assert.assertEquals(keyAgreementCredential.getSecretKey().getAlgorithm(), JCAConstants.KEY_ALGO_AES);
-        Assert.assertEquals(KeySupport.getKeyLength(keyAgreementCredential.getSecretKey()), Integer.valueOf(128));
+        final SecretKey skey = keyAgreementCredential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), JCAConstants.KEY_ALGO_AES);
+        Assert.assertEquals(KeySupport.getKeyLength(skey), Integer.valueOf(128));
         
         Assert.assertNull(keyAgreementCredential.getPublicKey());
         Assert.assertNull(keyAgreementCredential.getPrivateKey());
@@ -85,8 +86,9 @@ public class ECDHKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
         
         Assert.assertEquals(keyAgreementCredential.getParameters().size(), 2);
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(MockKeyDerivation.class));
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(KANonce.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(KANonce.class).getValue(), "AABBCCDD");
+        final KANonce kanonce = keyAgreementCredential.getParameters().get(KANonce.class);
+        assert kanonce != null;
+        Assert.assertEquals(kanonce.getValue(), "AABBCCDD");
         
     }
     
@@ -109,9 +111,10 @@ public class ECDHKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
         
         Assert.assertNotNull(keyAgreementCredential);
         
-        Assert.assertNotNull(keyAgreementCredential.getSecretKey());
-        Assert.assertEquals(keyAgreementCredential.getSecretKey().getAlgorithm(), JCAConstants.KEY_ALGO_AES);
-        Assert.assertEquals(KeySupport.getKeyLength(keyAgreementCredential.getSecretKey()), Integer.valueOf(128));
+        final SecretKey skey = keyAgreementCredential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), JCAConstants.KEY_ALGO_AES);
+        Assert.assertEquals(KeySupport.getKeyLength(skey), Integer.valueOf(128));
         
         Assert.assertNull(keyAgreementCredential.getPublicKey());
         Assert.assertNull(keyAgreementCredential.getPrivateKey());
@@ -131,8 +134,9 @@ public class ECDHKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
         Assert.assertEquals(keyAgreementCredential.getParameters().size(), 3);
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(PrivateCredential.class));
         Assert.assertTrue(keyAgreementCredential.getParameters().contains(MockKeyDerivation.class));
-        Assert.assertTrue(keyAgreementCredential.getParameters().contains(KANonce.class));
-        Assert.assertEquals(keyAgreementCredential.getParameters().get(KANonce.class).getValue(), "AABBCCDD");
+        final KANonce kanonce = keyAgreementCredential.getParameters().get(KANonce.class);
+        assert kanonce != null;
+        Assert.assertEquals(kanonce.getValue(), "AABBCCDD");
         
     }
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KANonceTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KANonceTest.java
index f60cac9dd..f10730271 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KANonceTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KANonceTest.java
@@ -26,14 +26,12 @@ import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.component.UnmodifiableComponentException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class KANonceTest extends XMLObjectBaseTestCase  {
     
     @Test
     public void basic() throws Exception {
-        KANonce nonce = new KANonce();
+        final KANonce nonce = new KANonce();
         nonce.setValue("AABBCCDD");
         nonce.initialize();
         Assert.assertEquals(nonce.getValue(), "AABBCCDD");
@@ -45,11 +43,11 @@ public class KANonceTest extends XMLObjectBaseTestCase  {
             // expected
         }
         
-        KANonce cloned  = nonce.clone();
+        final KANonce cloned  = nonce.clone();
         Assert.assertTrue(cloned.isInitialized());
         Assert.assertEquals(cloned.getValue(), "AABBCCDD");
         
-        XMLObject xmlObject = nonce.buildXMLObject();
+        final XMLObject xmlObject = nonce.buildXMLObject();
         Assert.assertNotNull(xmlObject);
         Assert.assertTrue(org.opensaml.xmlsec.encryption.KANonce.class.isInstance(xmlObject));
         org.opensaml.xmlsec.encryption.KANonce xmlNonce = org.opensaml.xmlsec.encryption.KANonce.class.cast(xmlObject);
@@ -59,13 +57,13 @@ public class KANonceTest extends XMLObjectBaseTestCase  {
     
     @Test()
     public void generatedValue() throws Exception {
-        KANonce nonce = new KANonce();
+        final KANonce nonce = new KANonce();
         // Don't generate a value unless initialized
         Assert.assertNull(nonce.getValue());
         nonce.initialize();
         
-        String initValue = nonce.getValue();
-        Assert.assertNotNull(initValue);
+        final String initValue = nonce.getValue();
+        assert initValue != null;
         Assert.assertEquals(Base64Support.decode(initValue).length, nonce.getGeneratedLength().intValue());
         // Once generated value shouldn't change
         Assert.assertEquals(nonce.getValue(), initValue);
@@ -74,21 +72,21 @@ public class KANonceTest extends XMLObjectBaseTestCase  {
     
     @Test()
     public void generatedLength() throws Exception {
-        KANonce nonce = new KANonce();
+        final KANonce nonce = new KANonce();
         nonce.setGeneratedLength(16);
         nonce.initialize();
         
-        String initValue = nonce.getValue();
-        Assert.assertNotNull(initValue);
+        final String initValue = nonce.getValue();
+        assert initValue != null;
         Assert.assertEquals(Base64Support.decode(initValue).length, nonce.getGeneratedLength().intValue());
     }
     
     @Test
     public void fromXMLObject() throws Exception {
-        org.opensaml.xmlsec.encryption.KANonce xmlObject = buildXMLObject(org.opensaml.xmlsec.encryption.KANonce.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.encryption.KANonce xmlObject = buildXMLObject(org.opensaml.xmlsec.encryption.KANonce.DEFAULT_ELEMENT_NAME);
         xmlObject.setValue("AABBCCDD");
         
-        KANonce parameter = KANonce.fromXMLObject(xmlObject);
+        final KANonce parameter = KANonce.fromXMLObject(xmlObject);
         Assert.assertNotNull(parameter);
         Assert.assertTrue(parameter.isInitialized());
         Assert.assertEquals(parameter.getValue(), "AABBCCDD");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParserTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParserTest.java
index 8dd3e7a83..a07c77f5f 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParserTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/KeyAgreementParametersParserTest.java
@@ -39,27 +39,25 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
     
     @Test
     public void ECDHWithConcatKDF() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
         
-        KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
+        final KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
         kdm.setAlgorithm(EncryptionConstants.ALGO_ID_KEYDERIVATION_CONCATKDF);
         
-        ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
+        final ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
         xmlParams.setAlgorithmID("00AA");
         xmlParams.setPartyUInfo("00BB");
         xmlParams.setPartyVInfo("00CC");
         xmlParams.setSuppPubInfo("00DD");
         xmlParams.setSuppPrivInfo("00EE");
         
-        org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
         digestMethod.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA512);
         xmlParams.setDigestMethod(digestMethod);
         
@@ -67,15 +65,14 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
         
         agreementMethod.getUnknownXMLObjects().add(kdm);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
-        KeyAgreementParameters parameters = parser.parse(agreementMethod);
+        final KeyAgreementParameters parameters = parser.parse(agreementMethod);
         Assert.assertNotNull(parameters);
         Assert.assertEquals(parameters.size(), 1);
         
-        Assert.assertTrue(parameters.contains(ConcatKDF.class));
-        
-        ConcatKDF kdf = parameters.get(ConcatKDF.class);
+        final ConcatKDF kdf = parameters.get(ConcatKDF.class);
+        assert kdf != null;
         Assert.assertTrue(kdf.isInitialized());
         Assert.assertEquals(kdf.getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
         Assert.assertEquals(kdf.getAlgorithmID(), "AA");
@@ -87,33 +84,33 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
     
     @Test
     public void ECDHWithConcatKDFWithKeySize() throws KeyAgreementException {
-        org.opensaml.xmlsec.encryption.KeySize xmlKeySize = buildXMLObject(org.opensaml.xmlsec.encryption.KeySize.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.encryption.KeySize xmlKeySize = buildXMLObject(org.opensaml.xmlsec.encryption.KeySize.DEFAULT_ELEMENT_NAME);
         xmlKeySize.setValue(80);
         
-        EncryptionMethod em = buildXMLObject(EncryptionMethod.DEFAULT_ELEMENT_NAME);
+        final EncryptionMethod em = buildXMLObject(EncryptionMethod.DEFAULT_ELEMENT_NAME);
         em.setKeySize(xmlKeySize);
         
-        EncryptedData ed = buildXMLObject(EncryptedData.DEFAULT_ELEMENT_NAME);
+        final EncryptedData ed = buildXMLObject(EncryptedData.DEFAULT_ELEMENT_NAME);
         ed.setEncryptionMethod(em);
         
-        KeyInfo keyInfo = buildXMLObject(KeyInfo.DEFAULT_ELEMENT_NAME);
+        final KeyInfo keyInfo = buildXMLObject(KeyInfo.DEFAULT_ELEMENT_NAME);
         ed.setKeyInfo(keyInfo);
         
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
         keyInfo.getAgreementMethods().add(agreementMethod);
         
-        KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
+        final KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
         kdm.setAlgorithm(EncryptionConstants.ALGO_ID_KEYDERIVATION_CONCATKDF);
         
-        ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
+        final ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
         xmlParams.setAlgorithmID("00AA");
         xmlParams.setPartyUInfo("00BB");
         xmlParams.setPartyVInfo("00CC");
         xmlParams.setSuppPubInfo("00DD");
         xmlParams.setSuppPrivInfo("00EE");
         
-        org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
         digestMethod.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA512);
         xmlParams.setDigestMethod(digestMethod);
         
@@ -121,15 +118,14 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
         
         agreementMethod.getUnknownXMLObjects().add(kdm);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
-        KeyAgreementParameters parameters = parser.parse(agreementMethod);
+        final KeyAgreementParameters parameters = parser.parse(agreementMethod);
         Assert.assertNotNull(parameters);
         Assert.assertEquals(parameters.size(), 2);
         
-        Assert.assertTrue(parameters.contains(ConcatKDF.class));
-        
-        ConcatKDF kdf = parameters.get(ConcatKDF.class);
+        final ConcatKDF kdf = parameters.get(ConcatKDF.class);
+        assert kdf != null;
         Assert.assertTrue(kdf.isInitialized());
         Assert.assertEquals(kdf.getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
         Assert.assertEquals(kdf.getAlgorithmID(), "AA");
@@ -138,34 +134,35 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
         Assert.assertEquals(kdf.getSuppPubInfo(), "DD");
         Assert.assertEquals(kdf.getSuppPrivInfo(), "EE");
         
-        Assert.assertTrue(parameters.contains(KeySize.class));
-        Assert.assertEquals(parameters.get(KeySize.class).getSize().intValue(), 80);
+        final KeySize keySize = parameters.get(KeySize.class);
+        assert keySize != null;
+        Assert.assertEquals(keySize.getSize(), 80);
     }
     
     @Test
     public void ECDHWithPBKDF2() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
         
-        KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
+        final KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
         kdm.setAlgorithm(EncryptionConstants.ALGO_ID_KEYDERIVATION_PBKDF2);
         
-        PBKDF2Params xmlParams = buildXMLObject(PBKDF2Params.DEFAULT_ELEMENT_NAME);
+        final PBKDF2Params xmlParams = buildXMLObject(PBKDF2Params.DEFAULT_ELEMENT_NAME);
         
-        IterationCount iterationCount = buildXMLObject(IterationCount.DEFAULT_ELEMENT_NAME);
+        final IterationCount iterationCount = buildXMLObject(IterationCount.DEFAULT_ELEMENT_NAME);
         iterationCount.setValue(1500);
         xmlParams.setIterationCount(iterationCount);
         
-        KeyLength keyLength = buildXMLObject(KeyLength.DEFAULT_ELEMENT_NAME);
+        final KeyLength keyLength = buildXMLObject(KeyLength.DEFAULT_ELEMENT_NAME);
         keyLength.setValue(32);
         xmlParams.setKeyLength(keyLength);
         
-        PRF prf = buildXMLObject(PRF.DEFAULT_ELEMENT_NAME);
+        final PRF prf = buildXMLObject(PRF.DEFAULT_ELEMENT_NAME);
         prf.setAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
         xmlParams.setPRF(prf);
         
-        Salt salt = buildXMLObject(Salt.DEFAULT_ELEMENT_NAME);
-        Specified specified = buildXMLObject(Specified.DEFAULT_ELEMENT_NAME);
+        final Salt salt = buildXMLObject(Salt.DEFAULT_ELEMENT_NAME);
+        final Specified specified = buildXMLObject(Specified.DEFAULT_ELEMENT_NAME);
         specified.setValue("ABCD");
         salt.setSpecified(specified);
         xmlParams.setSalt(salt);
@@ -174,38 +171,37 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
         
         agreementMethod.getUnknownXMLObjects().add(kdm);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
-        KeyAgreementParameters parameters = parser.parse(agreementMethod);
+        final KeyAgreementParameters parameters = parser.parse(agreementMethod);
         Assert.assertNotNull(parameters);
         Assert.assertEquals(parameters.size(), 1);
         
-        Assert.assertTrue(parameters.contains(PBKDF2.class));
-        
-        PBKDF2 kdf = parameters.get(PBKDF2.class);
+        final PBKDF2 kdf = parameters.get(PBKDF2.class);
+        assert kdf != null;
         Assert.assertTrue(kdf.isInitialized());
-        Assert.assertEquals(kdf.getIterationCount().intValue(), 1500);
-        Assert.assertEquals(kdf.getKeyLength().intValue(), 256);
+        Assert.assertEquals(kdf.getIterationCount(), 1500);
+        Assert.assertEquals(kdf.getKeyLength(), 256);
         Assert.assertEquals(kdf.getPRF(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
         Assert.assertEquals(kdf.getSalt(), "ABCD");
     }
 
     @Test
     public void DHWithConcatKDF() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF);
         
-        KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
+        final KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
         kdm.setAlgorithm(EncryptionConstants.ALGO_ID_KEYDERIVATION_CONCATKDF);
         
-        ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
+        final ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
         xmlParams.setAlgorithmID("00AA");
         xmlParams.setPartyUInfo("00BB");
         xmlParams.setPartyVInfo("00CC");
         xmlParams.setSuppPubInfo("00DD");
         xmlParams.setSuppPrivInfo("00EE");
         
-        org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
         digestMethod.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA512);
         xmlParams.setDigestMethod(digestMethod);
         
@@ -213,15 +209,14 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
         
         agreementMethod.getUnknownXMLObjects().add(kdm);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
-        KeyAgreementParameters parameters = parser.parse(agreementMethod);
+        final KeyAgreementParameters parameters = parser.parse(agreementMethod);
         Assert.assertNotNull(parameters);
         Assert.assertEquals(parameters.size(), 1);
         
-        Assert.assertTrue(parameters.contains(ConcatKDF.class));
-        
-        ConcatKDF kdf = parameters.get(ConcatKDF.class);
+        final ConcatKDF kdf = parameters.get(ConcatKDF.class);
+        assert kdf != null;
         Assert.assertTrue(kdf.isInitialized());
         Assert.assertEquals(kdf.getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
         Assert.assertEquals(kdf.getAlgorithmID(), "AA");
@@ -233,78 +228,78 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
     
     @Test
     public void DHWithLegacyKDF() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH);
         
-        org.opensaml.xmlsec.encryption.KANonce xmlNonce = buildXMLObject(org.opensaml.xmlsec.encryption.KANonce.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.encryption.KANonce xmlNonce = buildXMLObject(org.opensaml.xmlsec.encryption.KANonce.DEFAULT_ELEMENT_NAME);
         xmlNonce.setValue("ABCD");
         agreementMethod.getUnknownXMLObjects().add(xmlNonce);
         
-        org.opensaml.xmlsec.signature.DigestMethod xmlDigest = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.signature.DigestMethod xmlDigest = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
         xmlDigest.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA512);
         agreementMethod.getUnknownXMLObjects().add(xmlDigest);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
-        KeyAgreementParameters parameters = parser.parse(agreementMethod);
+        final KeyAgreementParameters parameters = parser.parse(agreementMethod);
         Assert.assertNotNull(parameters);
         Assert.assertEquals(parameters.size(), 2);
         
-        Assert.assertTrue(parameters.contains(KANonce.class));
-        KANonce nonce = parameters.get(KANonce.class);
+        final KANonce nonce = parameters.get(KANonce.class);
+        assert nonce != null;
         Assert.assertTrue(nonce.isInitialized());
         Assert.assertEquals(nonce.getValue(), "ABCD");
         Assert.assertTrue(parameters.contains(KANonce.class));
         
-        Assert.assertTrue(parameters.contains(DigestMethod.class));
-        DigestMethod digestMethod = parameters.get(DigestMethod.class);
+        final DigestMethod digestMethod = parameters.get(DigestMethod.class);
+        assert digestMethod != null;
         Assert.assertTrue(digestMethod.isInitialized());
         Assert.assertEquals(digestMethod.getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
     }
     
     @Test(expectedExceptions = KeyAgreementException.class)
     public void unknownChildType() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
         
         agreementMethod.getUnknownXMLObjects().add(buildXMLObject(simpleXMLObjectQName));
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
         parser.parse(agreementMethod);
     }
     
     @Test(expectedExceptions = KeyAgreementException.class)
     public void unknownKeyDerivationAlgorithm() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
         
-        KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
+        final KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
         kdm.setAlgorithm("UNKNOWN");
         
         agreementMethod.getUnknownXMLObjects().add(kdm);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
         parser.parse(agreementMethod);
     }
     
     @Test(expectedExceptions = KeyAgreementException.class)
     public void invalidParamData() throws KeyAgreementException {
-        AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
+        final AgreementMethod agreementMethod = buildXMLObject(AgreementMethod.DEFAULT_ELEMENT_NAME);
         agreementMethod.setAlgorithm(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
         
-        KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
+        final KeyDerivationMethod kdm = buildXMLObject(KeyDerivationMethod.DEFAULT_ELEMENT_NAME);
         kdm.setAlgorithm(EncryptionConstants.ALGO_ID_KEYDERIVATION_CONCATKDF);
         
-        ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
+        final ConcatKDFParams xmlParams = buildXMLObject(ConcatKDFParams.DEFAULT_ELEMENT_NAME);
         xmlParams.setAlgorithmID("01AA");
         xmlParams.setPartyUInfo("02BB");
         xmlParams.setPartyVInfo("03CC");
         xmlParams.setSuppPubInfo("04DD");
         xmlParams.setSuppPrivInfo("05EE");
         
-        org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+        final org.opensaml.xmlsec.signature.DigestMethod digestMethod = buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
         digestMethod.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA512);
         xmlParams.setDigestMethod(digestMethod);
         
@@ -312,8 +307,9 @@ public class KeyAgreementParametersParserTest extends XMLObjectBaseTestCase {
         
         agreementMethod.getUnknownXMLObjects().add(kdm);
         
-        KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
+        final KeyAgreementParametersParser parser = new KeyAgreementParametersParser();
         
         parser.parse(agreementMethod);
     }
-}
+
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/PrivateCredentialTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/PrivateCredentialTest.java
index f7707517e..4b22a3445 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/PrivateCredentialTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/PrivateCredentialTest.java
@@ -31,9 +31,7 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.logic.ConstraintViolationException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class PrivateCredentialTest extends OpenSAMLInitBaseTestCase  {
     
     @Test
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/tests/KeyAgreementSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/tests/KeyAgreementSupportTest.java
index 2dd8f270b..dfa269e56 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/tests/KeyAgreementSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/tests/KeyAgreementSupportTest.java
@@ -38,9 +38,7 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class KeyAgreementSupportTest extends XMLObjectBaseTestCase {
     
     @Test
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
index a3dff2eb7..c5fad86fe 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
@@ -76,9 +76,7 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class AlgorithmDescriptorsTest {
    
     // BlockEncryption
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
index 85e2eee14..963bc2a04 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
@@ -134,7 +134,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
     @Test
     public void testGlobalRegistryPresence() {
         AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
-        Assert.assertNotNull(registry);
+        assert registry != null;
         
         // Test all expected types from default auto-loaded set
         
@@ -202,7 +202,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
     @Test
     public void testGlobalRegistryGetByType() {
         AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
-        Assert.assertNotNull(registry);
+        assert registry != null;
         
         // Test all expected types from default auto-loaded set
         Set<String> byType = null;
@@ -285,7 +285,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
     @Test(dataProvider = "loadBCTestData")
     public void testGlobalRegistryRuntimeSupported(boolean loadBC) throws InitializationException {
         AlgorithmRegistry originalRegistry = AlgorithmSupport.getGlobalAlgorithmRegistry();
-        Assert.assertNotNull(originalRegistry);
+        assert originalRegistry != null;
         AlgorithmRegistry registry = originalRegistry;
         
         if (loadBC) {
@@ -294,7 +294,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
             registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
         }
         
-        Assert.assertNotNull(registry);
+        assert registry != null;
         
         try {
             // First test all default algos expected to be supported unconditionally on 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmSupportTest.java
index 68fa9bdfa..ff55da5c5 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmSupportTest.java
@@ -73,6 +73,7 @@ import org.testng.annotations.Test;
 /**
  * Unit test for {@link KeySupport}.
  */
+ at SuppressWarnings("javadoc")
 public class AlgorithmSupportTest extends OpenSAMLInitBaseTestCase {
     
     @Test
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrapTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrapTest.java
index e31190c38..a9d045173 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrapTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrapTest.java
@@ -29,18 +29,16 @@ import org.opensaml.xmlsec.encryption.support.KeyAgreementEncryptionConfiguratio
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DefaultSecurityConfigurationBootstrapTest {
     
     @Test
     public void testECDHDefaultKDF() {
-        Map<String, KeyAgreementEncryptionConfiguration> kaConfigs = DefaultSecurityConfigurationBootstrap.buildKeyAgreementConfigurations();
+        final Map<String, KeyAgreementEncryptionConfiguration> kaConfigs = DefaultSecurityConfigurationBootstrap.buildKeyAgreementConfigurations();
         Assert.assertTrue(kaConfigs.containsKey(JCAConstants.KEY_ALGO_EC));
         
-        KeyAgreementEncryptionConfiguration config = kaConfigs.get(JCAConstants.KEY_ALGO_EC);
-        KeyDerivation keyDerivation = config.getParameters().stream()
+        final KeyAgreementEncryptionConfiguration config = kaConfigs.get(JCAConstants.KEY_ALGO_EC);
+        final KeyDerivation keyDerivation = config.getParameters().stream()
                 .filter(KeyDerivation.class::isInstance)
                 .map(KeyDerivation.class::cast)
                 .findFirst().orElse(null);
@@ -51,14 +49,14 @@ public class DefaultSecurityConfigurationBootstrapTest {
     @Test
     public void testECDHConcatKDF() {
         try {
-            Properties props = new Properties();
+            final Properties props = new Properties();
             props.setProperty("opensaml.config.ecdh.defaultKDF", "ConcatKDF");
             ThreadLocalConfigurationPropertiesHolder.setProperties(props);
             
-            Map<String, KeyAgreementEncryptionConfiguration> kaConfigs = DefaultSecurityConfigurationBootstrap.buildKeyAgreementConfigurations();
+            final Map<String, KeyAgreementEncryptionConfiguration> kaConfigs = DefaultSecurityConfigurationBootstrap.buildKeyAgreementConfigurations();
             Assert.assertTrue(kaConfigs.containsKey(JCAConstants.KEY_ALGO_EC));
         
-            KeyAgreementEncryptionConfiguration config = kaConfigs.get(JCAConstants.KEY_ALGO_EC);
+            final KeyAgreementEncryptionConfiguration config = kaConfigs.get(JCAConstants.KEY_ALGO_EC);
             KeyDerivation keyDerivation = config.getParameters().stream()
                     .filter(KeyDerivation.class::isInstance)
                     .map(KeyDerivation.class::cast)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/GlobalKeyAgreementProcessorRegistryTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/GlobalKeyAgreementProcessorRegistryTest.java
index 6b63136f3..715d92003 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/GlobalKeyAgreementProcessorRegistryTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/GlobalKeyAgreementProcessorRegistryTest.java
@@ -29,16 +29,14 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.collection.CollectionSupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class GlobalKeyAgreementProcessorRegistryTest extends OpenSAMLInitBaseTestCase {
     
     @Test
     public void basic() {
-       KeyAgreementProcessorRegistry registry = KeyAgreementSupport.getGlobalProcessorRegistry(); 
+       final KeyAgreementProcessorRegistry registry = KeyAgreementSupport.getGlobalProcessorRegistry(); 
+       assert registry != null;
        
-       Assert.assertNotNull(registry);
        Assert.assertEquals(registry.getRegisteredAlgorithms().size(), 3);
        
        Assert.assertEquals(registry.getRegisteredAlgorithms(), CollectionSupport.setOf(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES,
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/testing/TestXMLObjectProviderInitializer.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/testing/TestXMLObjectProviderInitializer.java
index ef68ddbe0..206e02de6 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/testing/TestXMLObjectProviderInitializer.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/config/impl/testing/TestXMLObjectProviderInitializer.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.config.impl.testing;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer;
 
 /**
@@ -25,12 +27,12 @@ import org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer;
 public class TestXMLObjectProviderInitializer extends AbstractXMLObjectProviderInitializer {
     
     /** Config resources. */
-    private static String[] configs = {
+    @Nonnull private static String[] configs = {
         "/xmlsec-test-config.xml",
         };
 
     /** {@inheritDoc} */
-    protected String[] getConfigResources() {
+    @Nonnull protected String[] getConfigResources() {
         return configs;
     }
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/crypto/tests/XMLSigningUtilTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/crypto/tests/XMLSigningUtilTest.java
index 195331b59..9a2411d69 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/crypto/tests/XMLSigningUtilTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/crypto/tests/XMLSigningUtilTest.java
@@ -43,6 +43,7 @@ import org.opensaml.xmlsec.signature.support.SignatureConstants;
 /**
  * Test the SigningUtil operations for generating and verifying simple, raw signatures and MAC's.
  */
+ at SuppressWarnings("javadoc")
 public class XMLSigningUtilTest extends OpenSAMLInitBaseTestCase {
     
     private SecretKey secretKeyAES128;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java
index b7c0b42ad..c5c503012 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/ConcatKDFTest.java
@@ -37,9 +37,7 @@ import org.testng.annotations.Test;
 import net.shibboleth.shared.codec.EncodingException;
 import net.shibboleth.shared.component.ComponentInitializationException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class ConcatKDFTest extends XMLObjectBaseTestCase {
     
     @Test
@@ -154,8 +152,9 @@ public class ConcatKDFTest extends XMLObjectBaseTestCase {
         Assert.assertEquals(kdmParams.getSuppPubInfo(), "00DD");
         Assert.assertEquals(kdmParams.getSuppPrivInfo(), "00EE");
         
-        Assert.assertNotNull(kdmParams.getDigestMethod());
-        Assert.assertEquals(kdmParams.getDigestMethod().getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
+        final DigestMethod method = kdmParams.getDigestMethod();
+        assert method != null;
+        Assert.assertEquals(method.getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
     }
     
     @Test
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java
index 93c170c1d..66db07792 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/DHLegacyKDFTest.java
@@ -30,25 +30,25 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.codec.Base64Support;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DHLegacyKDFTest extends OpenSAMLInitBaseTestCase {
     
     @Test
     public void specTestVector() throws Exception {
         // This tests the example test data from XML Encryption 1.1 section 5.6.2.2.
-        DHLegacyKDF kdf = new DHLegacyKDF(); 
+        DHLegacyKDF kdf = new DHLegacyKDF();
         kdf.setDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA1);
         kdf.setNonce("Zm9v");
         
+        final String nonce = kdf.getNonce();
+        assert nonce != null;
         byte[] digestCounter1 = kdf.digest(
                 1,
                 JCAConstants.DIGEST_SHA1,
                 Hex.decodeHex("DEADBEEF"),
                 "Example:Block/Alg",
                 80,
-                Base64Support.decode(kdf.getNonce()));
+                Base64Support.decode(nonce));
         
         // The value in the original spec document Example 41 is incorrect, as indicated by the errata:
         // https://www.w3.org/2008/xmlsec/errata/xmlenc-core-11-errata.html
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java
index b17f90398..25c827e2b 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.derivation.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
 import org.opensaml.security.crypto.KeySupport;
@@ -30,19 +32,22 @@ import org.opensaml.xmlsec.derivation.KeyDerivationException;
 public class MockKeyDerivation implements KeyDerivation {
 
     /** {@inheritDoc} */
-    public String getAlgorithm() {
+    @Nonnull public String getAlgorithm() {
         return "urn:test:MockKeyDerivation";
     }
 
     /** {@inheritDoc} */
-    public SecretKey derive(byte[] secret, String keyAlgorithm, Integer keyLength) throws KeyDerivationException {
+    @Nonnull public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
+            @Nullable final Integer keyLength) throws KeyDerivationException {
         try {
-            String algo = AlgorithmSupport.getKeyAlgorithm(keyAlgorithm);
-            Integer length = AlgorithmSupport.getKeyLength(keyAlgorithm);
+            final String algo = AlgorithmSupport.getKeyAlgorithm(keyAlgorithm);
+            assert algo != null;
+            final Integer length = AlgorithmSupport.getKeyLength(keyAlgorithm);
+            assert length != null;
             return KeySupport.generateKey(algo, length, null);
         } catch (Exception e) {
             throw new KeyDerivationException("Error generating mock derived key", e);
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
index 8a369823f..7c8fd86be 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/PBKDF2Test.java
@@ -19,6 +19,7 @@ package org.opensaml.xmlsec.derivation.impl;
 
 import java.security.SecureRandom;
 
+import javax.annotation.Nonnull;
 import javax.crypto.SecretKey;
 
 import org.apache.commons.codec.DecoderException;
@@ -51,9 +52,7 @@ import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.EncodingException;
 import net.shibboleth.shared.component.ComponentInitializationException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class PBKDF2Test extends XMLObjectBaseTestCase {
     
     @Test
@@ -86,9 +85,9 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         
         Assert.assertEquals(kdf.getAlgorithm(), EncryptionConstants.ALGO_ID_KEYDERIVATION_PBKDF2);
         
-        Assert.assertEquals(kdf.getGeneratedSaltLength().intValue(), 16);
-        Assert.assertEquals(kdf.getIterationCount().intValue(), 3000);
-        Assert.assertEquals(kdf.getKeyLength().intValue(), 256);
+        Assert.assertEquals(kdf.getGeneratedSaltLength(), 16);
+        Assert.assertEquals(kdf.getIterationCount(), 3000);
+        Assert.assertEquals(kdf.getKeyLength(), 256);
         Assert.assertEquals(kdf.getPRF(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
         Assert.assertSame(kdf.getRandom(), sr);
         Assert.assertEquals(kdf.getSalt(), "ABCD");
@@ -134,18 +133,23 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         
         PBKDF2Params kdmParams = PBKDF2Params.class.cast(kdm.getUnknownXMLObjects().get(0));
         
-        Assert.assertNotNull(kdmParams.getIterationCount());
-        Assert.assertEquals(kdmParams.getIterationCount().getValue().intValue(), 3000);
+        final IterationCount icount = kdmParams.getIterationCount();
+        assert icount != null;
+        Assert.assertEquals(icount.getValue(), 3000);
         
-        Assert.assertNotNull(kdmParams.getKeyLength());
-        Assert.assertEquals(kdmParams.getKeyLength().getValue().intValue(), 32); // bytes = 256/8
+        final KeyLength klen = kdmParams.getKeyLength();
+        assert klen != null;
+        Assert.assertEquals(klen.getValue(), 32); // bytes = 256/8
         
-        Assert.assertNotNull(kdmParams.getPRF());
-        Assert.assertEquals(kdmParams.getPRF().getAlgorithm(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
+        final PRF prf = kdmParams.getPRF();
+        assert prf != null;
+        Assert.assertEquals(prf.getAlgorithm(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
         
-        Assert.assertNotNull(kdmParams.getSalt());
-        Assert.assertNotNull(kdmParams.getSalt().getSpecified());
-        Assert.assertEquals(kdmParams.getSalt().getSpecified().getValue(), "ABCD");
+        final Salt salt = kdmParams.getSalt();
+        assert salt != null;
+        final Specified spec = salt.getSpecified();
+        assert spec != null;
+        Assert.assertEquals(spec.getValue(), "ABCD");
     }
     
     @Test
@@ -178,8 +182,8 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         Assert.assertNotNull(parameter);
         Assert.assertTrue(parameter.isInitialized());
         
-        Assert.assertEquals(parameter.getIterationCount().intValue(), 3000);
-        Assert.assertEquals(parameter.getKeyLength().intValue(), 128);
+        Assert.assertEquals(parameter.getIterationCount(), 3000);
+        Assert.assertEquals(parameter.getKeyLength(), 128);
         Assert.assertEquals(parameter.getPRF(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
         Assert.assertEquals(parameter.getSalt(), "ABCD");
         
@@ -262,9 +266,9 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         Assert.assertNotSame(cloned, kdf);
         
         Assert.assertNotNull(cloned);
-        Assert.assertEquals(cloned.getGeneratedSaltLength().intValue(), 16);
-        Assert.assertEquals(cloned.getIterationCount().intValue(), 3000);
-        Assert.assertEquals(cloned.getKeyLength().intValue(), 256);
+        Assert.assertEquals(cloned.getGeneratedSaltLength(), 16);
+        Assert.assertEquals(cloned.getIterationCount(), 3000);
+        Assert.assertEquals(cloned.getKeyLength(), 256);
         Assert.assertEquals(cloned.getPRF(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
         Assert.assertSame(cloned.getRandom(), sr);
         Assert.assertEquals(cloned.getSalt(), "ABCD");
@@ -284,11 +288,12 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         Assert.assertEquals(derivedKey.getEncoded().length * 8, 128);
         
         // Salt and key length were dynamically generated, so sanity check the new property values
-        Assert.assertNotNull(kdf.getSalt());
-        Assert.assertEquals(Base64Support.decode(kdf.getSalt()).length, kdf.getGeneratedSaltLength().intValue());
+        final String salt = kdf.getSalt();
+        assert salt != null;
+        Assert.assertEquals(Base64Support.decode(salt).length, kdf.getGeneratedSaltLength());
         
         Assert.assertNotNull(kdf.getKeyLength());
-        Assert.assertEquals(kdf.getKeyLength().intValue(), 128);
+        Assert.assertEquals(kdf.getKeyLength(), 128);
         
     }
     
@@ -365,7 +370,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     
     @BeforeClass
     public void setupTestVectorAlgorithms() {
-        AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
+        final AlgorithmRegistry registry = AlgorithmSupport.ensureGlobalAlgorithmRegistry();
         registry.register(new MockKeyAlgorithm128());
         registry.register(new MockKeyAlgorithm160());
         registry.register(new MockKeyAlgorithm200());
@@ -375,7 +380,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     
     @AfterClass
     public void teardownTestVectorAlgorithms() {
-        AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
+        final AlgorithmRegistry registry = AlgorithmSupport.ensureGlobalAlgorithmRegistry();
         registry.deregister(new MockKeyAlgorithm128());
         registry.deregister(new MockKeyAlgorithm160());
         registry.deregister(new MockKeyAlgorithm200());
@@ -549,7 +554,7 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
         
         Assert.assertNotNull(derivedKey);
         Assert.assertEquals(derivedKey.getAlgorithm(), jcaKeyAlgorithm);
-        Assert.assertEquals(derivedKey.getEncoded().length * 8, jcaKeyLength.intValue());
+        Assert.assertEquals(derivedKey.getEncoded().length * 8, jcaKeyLength);
         Assert.assertEquals(derivedKey.getEncoded(), keyBytes);
     }
     
@@ -558,39 +563,39 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     private class MockKeyAlgorithm128 implements BlockEncryptionAlgorithm {
 
         /** {@inheritDoc} */
-        public String getKey() {
+        @Nonnull public String getKey() {
             return "MockKey";
         }
 
         /** {@inheritDoc} */
-        public String getURI() {
+        @Nonnull public String getURI() {
             return "urn:test:MockKeyAlgorithm:128";
         }
 
         /** {@inheritDoc} */
-        public Integer getKeyLength() {
+        @Nonnull public Integer getKeyLength() {
             // 16 bytes
             return 128;
         }
 
         /** {@inheritDoc} */
-        public AlgorithmType getType() {
+        @Nonnull public AlgorithmType getType() {
             return AlgorithmType.BlockEncryption;
         }
 
         /** {@inheritDoc} */
-        public String getJCAAlgorithmID() {
-            return null;
+        @Nonnull public String getJCAAlgorithmID() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getCipherMode() {
-            return null;
+        @Nonnull public String getCipherMode() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getPadding() {
-            return null;
+        @Nonnull public String getPadding() {
+            throw new UnsupportedOperationException();
         }
         
     }
@@ -598,39 +603,39 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     private class MockKeyAlgorithm160 implements BlockEncryptionAlgorithm {
 
         /** {@inheritDoc} */
-        public String getKey() {
+        @Nonnull public String getKey() {
             return "MockKey";
         }
 
         /** {@inheritDoc} */
-        public String getURI() {
+        @Nonnull public String getURI() {
             return "urn:test:MockKeyAlgorithm:160";
         }
 
         /** {@inheritDoc} */
-        public Integer getKeyLength() {
+        @Nonnull public Integer getKeyLength() {
             // 20 bytes
             return 160;
         }
 
         /** {@inheritDoc} */
-        public AlgorithmType getType() {
+        @Nonnull public AlgorithmType getType() {
             return AlgorithmType.BlockEncryption;
         }
 
         /** {@inheritDoc} */
-        public String getJCAAlgorithmID() {
-            return null;
+        @Nonnull public String getJCAAlgorithmID() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getCipherMode() {
-            return null;
+        @Nonnull public String getCipherMode() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getPadding() {
-            return null;
+        @Nonnull public String getPadding() {
+            throw new UnsupportedOperationException();
         }
         
     }
@@ -638,39 +643,39 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     private class MockKeyAlgorithm200 implements BlockEncryptionAlgorithm {
 
         /** {@inheritDoc} */
-        public String getKey() {
+        @Nonnull public String getKey() {
             return "MockKey";
         }
 
         /** {@inheritDoc} */
-        public String getURI() {
+        @Nonnull public String getURI() {
             return "urn:test:MockKeyAlgorithm:200";
         }
 
         /** {@inheritDoc} */
-        public Integer getKeyLength() {
+        @Nonnull public Integer getKeyLength() {
             // 25 bytes
             return 200;
         }
 
         /** {@inheritDoc} */
-        public AlgorithmType getType() {
+        @Nonnull public AlgorithmType getType() {
             return AlgorithmType.BlockEncryption;
         }
 
         /** {@inheritDoc} */
-        public String getJCAAlgorithmID() {
-            return null;
+        @Nonnull public String getJCAAlgorithmID() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getCipherMode() {
-            return null;
+        @Nonnull public String getCipherMode() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getPadding() {
-            return null;
+        @Nonnull public String getPadding() {
+            throw new UnsupportedOperationException();
         }
         
     }
@@ -678,39 +683,39 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     private class MockKeyAlgorithm256 implements BlockEncryptionAlgorithm {
 
         /** {@inheritDoc} */
-        public String getKey() {
+        @Nonnull public String getKey() {
             return "MockKey";
         }
 
         /** {@inheritDoc} */
-        public String getURI() {
+        @Nonnull public String getURI() {
             return "urn:test:MockKeyAlgorithm:256";
         }
 
         /** {@inheritDoc} */
-        public Integer getKeyLength() {
+        @Nonnull public Integer getKeyLength() {
             // 32 bytes
             return 256;
         }
 
         /** {@inheritDoc} */
-        public AlgorithmType getType() {
+        @Nonnull public AlgorithmType getType() {
             return AlgorithmType.BlockEncryption;
         }
 
         /** {@inheritDoc} */
-        public String getJCAAlgorithmID() {
-            return null;
+        @Nonnull public String getJCAAlgorithmID() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getCipherMode() {
-            return null;
+        @Nonnull public String getCipherMode() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getPadding() {
-            return null;
+        @Nonnull public String getPadding() {
+            throw new UnsupportedOperationException();
         }
         
     }
@@ -718,39 +723,39 @@ public class PBKDF2Test extends XMLObjectBaseTestCase {
     private class MockKeyAlgorithm320 implements BlockEncryptionAlgorithm {
 
         /** {@inheritDoc} */
-        public String getKey() {
+        @Nonnull public String getKey() {
             return "MockKey";
         }
 
         /** {@inheritDoc} */
-        public String getURI() {
+        @Nonnull public String getURI() {
             return "urn:test:MockKeyAlgorithm:320";
         }
 
         /** {@inheritDoc} */
-        public Integer getKeyLength() {
+        @Nonnull public Integer getKeyLength() {
             // 40 bytes
             return 320;
         }
 
         /** {@inheritDoc} */
-        public AlgorithmType getType() {
+        @Nonnull public AlgorithmType getType() {
             return AlgorithmType.BlockEncryption;
         }
 
         /** {@inheritDoc} */
-        public String getJCAAlgorithmID() {
-            return null;
+        @Nonnull public String getJCAAlgorithmID() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getCipherMode() {
-            return null;
+        @Nonnull public String getCipherMode() {
+            throw new UnsupportedOperationException();
         }
 
         /** {@inheritDoc} */
-        public String getPadding() {
-            return null;
+        @Nonnull public String getPadding() {
+            throw new UnsupportedOperationException();
         }
         
     }
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java
index 8b4d32aec..fcb779783 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/tests/KeyDerivationSupportTest.java
@@ -25,9 +25,7 @@ import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class KeyDerivationSupportTest extends OpenSAMLInitBaseTestCase {
     
     @Test
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/AESGCMTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/AESGCMTest.java
index b1e6d3847..3fd6d10e0 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/AESGCMTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/AESGCMTest.java
@@ -28,6 +28,7 @@ import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.opensaml.xmlsec.algorithm.KeyLengthSpecifiedAlgorithm;
 import org.opensaml.xmlsec.encryption.EncryptedData;
+import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.support.DataEncryptionParameters;
 import org.opensaml.xmlsec.encryption.support.Decrypter;
 import org.opensaml.xmlsec.encryption.support.Encrypter;
@@ -39,10 +40,8 @@ import org.slf4j.LoggerFactory;
 import org.testng.Assert;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
+import org.w3c.dom.Element;
 
-/**
- *
- */
 @SuppressWarnings("javadoc")
 public class AESGCMTest extends XMLObjectBaseTestCase {
     
@@ -62,7 +61,7 @@ public class AESGCMTest extends XMLObjectBaseTestCase {
     
     @DataProvider
     public Object[][] testDataAESGCM() {
-        AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
+        final AlgorithmRegistry registry = AlgorithmSupport.ensureGlobalAlgorithmRegistry();
         AlgorithmDescriptor aesGCM128 = registry.get(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM);
         AlgorithmDescriptor aesGCM192 = registry.get(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM);
         AlgorithmDescriptor aesGCM256 = registry.get(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM);
@@ -101,30 +100,35 @@ public class AESGCMTest extends XMLObjectBaseTestCase {
                 providerSupport.loadBC();
             }
         
-            SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) unmarshallElement(targetFile);
+            final SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) unmarshallElement(targetFile);
+            assert sxo != null;
             
-            Credential encCred = AlgorithmSupport.generateSymmetricKeyAndCredential(descriptor.getURI());
+            final Credential encCred = AlgorithmSupport.generateSymmetricKeyAndCredential(descriptor.getURI());
             
-            DataEncryptionParameters encParams = new DataEncryptionParameters();
+            final DataEncryptionParameters encParams = new DataEncryptionParameters();
             encParams.setAlgorithm(descriptor.getURI());
             encParams.setEncryptionCredential(encCred);
             
-            Encrypter encrypter = new Encrypter();
+            final Encrypter encrypter = new Encrypter();
             
-            EncryptedData encryptedData = encrypter.encryptElement(sxo, encParams);
+            final EncryptedData encryptedData = encrypter.encryptElement(sxo, encParams);
+            assert encryptedData != null;
             
-            Assert.assertNotNull(encryptedData);
-            Assert.assertEquals(encryptedData.getEncryptionMethod().getAlgorithm(), descriptor.getURI());
+            final EncryptionMethod method = encryptedData.getEncryptionMethod();
+            assert method != null;
+            Assert.assertEquals(method.getAlgorithm(), descriptor.getURI());
             
-            StaticKeyInfoCredentialResolver dataKeyInfoResolver = new StaticKeyInfoCredentialResolver(encCred);
+            final StaticKeyInfoCredentialResolver dataKeyInfoResolver = new StaticKeyInfoCredentialResolver(encCred);
             
-            Decrypter decrypter = new Decrypter(dataKeyInfoResolver, null, null);
+            final Decrypter decrypter = new Decrypter(dataKeyInfoResolver, null, null);
             
-            XMLObject decryptedXMLObject = decrypter.decryptData(encryptedData);
+            final XMLObject decryptedXMLObject = decrypter.decryptData(encryptedData);
             
             Assert.assertNotNull(decryptedXMLObject);
             Assert.assertTrue(decryptedXMLObject instanceof SignableSimpleXMLObject);
-            assertXMLEquals(sxo.getDOM().getOwnerDocument(), decryptedXMLObject);
+            final Element dom = sxo.getDOM();
+            assert dom != null;
+            assertXMLEquals(dom.getOwnerDocument(), decryptedXMLObject);
             
         } finally {
             providerSupport.unloadBC();
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ChainingEncryptedKeyResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ChainingEncryptedKeyResolverTest.java
index 048e381e9..4bf9a2bc7 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ChainingEncryptedKeyResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ChainingEncryptedKeyResolverTest.java
@@ -23,6 +23,8 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.xmlsec.encryption.EncryptedData;
@@ -32,6 +34,7 @@ import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
 import org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver;
 import org.opensaml.xmlsec.encryption.support.SimpleRetrievalMethodEncryptedKeyResolver;
 import org.opensaml.xmlsec.mock.SignableSimpleXMLObject;
+import org.opensaml.xmlsec.signature.KeyInfo;
 import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
@@ -64,15 +67,16 @@ public class ChainingEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
     public void testEmptyChain() {
         String filename =  "/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolverSingleInline.xml";
         SignableSimpleXMLObject sxo =  (SignableSimpleXMLObject) unmarshallElement(filename);
-        Assert.assertNotNull(sxo);
+        assert sxo != null;
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0));
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0).getEncryptedData());
         
         EncryptedData encData = sxo.getSimpleXMLObjects().get(0).getEncryptedData();
         
-        Assert.assertNotNull(encData.getKeyInfo());
-        Assert.assertFalse(encData.getKeyInfo().getEncryptedKeys().isEmpty());
-        Assert.assertTrue(encData.getKeyInfo().getRetrievalMethods().isEmpty());
+        final KeyInfo keyInfo = encData.getKeyInfo();
+        assert keyInfo != null;
+        Assert.assertFalse(keyInfo.getEncryptedKeys().isEmpty());
+        Assert.assertTrue(keyInfo.getRetrievalMethods().isEmpty());
         
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
@@ -87,15 +91,16 @@ public class ChainingEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
     public void testSingleEKInline() {
         String filename =  "/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolverSingleInline.xml";
         SignableSimpleXMLObject sxo =  (SignableSimpleXMLObject) unmarshallElement(filename);
-        Assert.assertNotNull(sxo);
+        assert sxo != null;
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0));
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0).getEncryptedData());
         
         EncryptedData encData = sxo.getSimpleXMLObjects().get(0).getEncryptedData();
         
-        Assert.assertNotNull(encData.getKeyInfo());
-        Assert.assertFalse(encData.getKeyInfo().getEncryptedKeys().isEmpty());
-        Assert.assertTrue(encData.getKeyInfo().getRetrievalMethods().isEmpty());
+        final KeyInfo keyInfo = encData.getKeyInfo();
+        assert keyInfo != null;
+        Assert.assertFalse(keyInfo.getEncryptedKeys().isEmpty());
+        Assert.assertTrue(keyInfo.getRetrievalMethods().isEmpty());
         
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
@@ -115,15 +120,16 @@ public class ChainingEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
     public void testSingleEKRetrievalMethod() {
         String filename =  "/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolverSingleRetrievalMethod.xml";
         SignableSimpleXMLObject sxo =  (SignableSimpleXMLObject) unmarshallElement(filename);
-        Assert.assertNotNull(sxo);
+        assert sxo != null;
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0));
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0).getEncryptedData());
         
         EncryptedData encData = sxo.getSimpleXMLObjects().get(0).getEncryptedData();
         
-        Assert.assertNotNull(encData.getKeyInfo());
-        Assert.assertTrue(encData.getKeyInfo().getEncryptedKeys().isEmpty());
-        Assert.assertFalse(encData.getKeyInfo().getRetrievalMethods().isEmpty());
+        final KeyInfo keyInfo = encData.getKeyInfo();
+        assert keyInfo != null;
+        Assert.assertTrue(keyInfo.getEncryptedKeys().isEmpty());
+        Assert.assertFalse(keyInfo.getRetrievalMethods().isEmpty());
         
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
@@ -143,15 +149,16 @@ public class ChainingEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
     public void testMultiEKWithOneRecipient() {
         String filename =  "/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolverMultiple.xml";
         SignableSimpleXMLObject sxo =  (SignableSimpleXMLObject) unmarshallElement(filename);
-        Assert.assertNotNull(sxo);
+        assert sxo != null;
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0));
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0).getEncryptedData());
         
         EncryptedData encData = sxo.getSimpleXMLObjects().get(0).getEncryptedData();
         
-        Assert.assertNotNull(encData.getKeyInfo());
-        Assert.assertFalse(encData.getKeyInfo().getEncryptedKeys().isEmpty());
-        Assert.assertFalse(encData.getKeyInfo().getRetrievalMethods().isEmpty());
+        final KeyInfo keyInfo = encData.getKeyInfo();
+        assert keyInfo != null;
+        Assert.assertFalse(keyInfo.getEncryptedKeys().isEmpty());
+        Assert.assertFalse(keyInfo.getRetrievalMethods().isEmpty());
         
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
@@ -172,15 +179,16 @@ public class ChainingEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
     public void testMultiEKWithTwoRecipients() {
         String filename =  "/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolverMultiple.xml";
         SignableSimpleXMLObject sxo =  (SignableSimpleXMLObject) unmarshallElement(filename);
-        Assert.assertNotNull(sxo);
+        assert sxo != null;
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0));
         Assert.assertNotNull(sxo.getSimpleXMLObjects().get(0).getEncryptedData());
         
         EncryptedData encData = sxo.getSimpleXMLObjects().get(0).getEncryptedData();
         
-        Assert.assertNotNull(encData.getKeyInfo());
-        Assert.assertFalse(encData.getKeyInfo().getEncryptedKeys().isEmpty());
-        Assert.assertFalse(encData.getKeyInfo().getRetrievalMethods().isEmpty());
+        final KeyInfo keyInfo = encData.getKeyInfo();
+        assert keyInfo != null;
+        Assert.assertFalse(keyInfo.getEncryptedKeys().isEmpty());
+        Assert.assertFalse(keyInfo.getRetrievalMethods().isEmpty());
         
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
@@ -205,9 +213,14 @@ public class ChainingEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
      * @param sxo the mock object to process
      * @return a list of EncryptedKey elements
      */
-    private List<EncryptedKey> getEncryptedKeys(SignableSimpleXMLObject sxo) {
+    private List<EncryptedKey> getEncryptedKeys(@Nonnull final SignableSimpleXMLObject sxo) {
         List<EncryptedKey> allKeys = new ArrayList<>();
-        allKeys.addAll(sxo.getSimpleXMLObjects().get(0).getEncryptedData().getKeyInfo().getEncryptedKeys());
+        
+        final EncryptedData edata = sxo.getSimpleXMLObjects().get(0).getEncryptedData();
+        assert edata != null;
+        final KeyInfo keyInfo = edata.getKeyInfo();
+        assert keyInfo != null;
+        allKeys.addAll(keyInfo.getEncryptedKeys());
         for (XMLObject xmlObject : sxo.getUnknownXMLObjects()) {
            if (xmlObject instanceof EncryptedKey)  {
                allKeys.add((EncryptedKey) xmlObject);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java
index be9a1a127..611c348f0 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java
@@ -73,9 +73,7 @@ import org.w3c.dom.Element;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.xml.SerializeSupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DHWithExplicitKDFTest extends XMLObjectBaseTestCase {
     
     private String targetFile;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java
index c6dd74bf6..a1e1564df 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java
@@ -74,9 +74,7 @@ import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.xml.SerializeSupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DHWithLegacyKDFTest extends XMLObjectBaseTestCase {
     
     private String targetFile;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DecryptionSignedContentTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DecryptionSignedContentTest.java
index f887f20fe..b761fe5f9 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DecryptionSignedContentTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DecryptionSignedContentTest.java
@@ -26,6 +26,8 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.security.KeyPair;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
@@ -107,7 +109,7 @@ public class DecryptionSignedContentTest extends XMLObjectBaseTestCase {
         Element signedElement = getSignedElement();
 
         // Unmarshall to XMLObject
-        XMLObject signedXMLObject = unmarshallerFactory.getUnmarshaller(signedElement).unmarshall(signedElement);
+        XMLObject signedXMLObject = unmarshallerFactory.ensureUnmarshaller(signedElement).unmarshall(signedElement);
         Assert.assertTrue(signedXMLObject instanceof SignableSimpleXMLObject);
         SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) signedXMLObject;
 
@@ -124,7 +126,7 @@ public class DecryptionSignedContentTest extends XMLObjectBaseTestCase {
         Document document = parserPool.parse(input);
         tempfile.delete();
         Element encDataElement = document.getDocumentElement();
-        XMLObject encryptedXMLObject = unmarshallerFactory.getUnmarshaller(encDataElement).unmarshall(encDataElement);
+        XMLObject encryptedXMLObject = unmarshallerFactory.ensureUnmarshaller(encDataElement).unmarshall(encDataElement);
         Assert.assertTrue(encryptedXMLObject instanceof EncryptedData);
         EncryptedData encryptedData2 = (EncryptedData) encryptedXMLObject;
 
@@ -135,14 +137,18 @@ public class DecryptionSignedContentTest extends XMLObjectBaseTestCase {
         Assert.assertTrue(decryptedXMLObject instanceof SignableSimpleXMLObject);
         SignableSimpleXMLObject decryptedSXO = (SignableSimpleXMLObject) decryptedXMLObject;
 
-        Signature decryptedSignature = decryptedSXO.getSignature();
+        final Signature decryptedSignature = decryptedSXO.getSignature();
+        assert decryptedSignature != null;
+        final Element sigDOM = decryptedSignature.getDOM();
+        assert sigDOM != null;
 
         // Sanity check that DOM-based ID resolution using Document getElementById
         // is working correctly
-        Element resolvedElement = decryptedSignature.getDOM().getOwnerDocument().getElementById(idValue);
+        final Element resolvedElement = sigDOM.getOwnerDocument().getElementById(idValue);
         Assert.assertNotNull(resolvedElement, "Document getElementById found no element");
-        Assert.assertTrue(decryptedSXO.getDOM()
-                .isSameNode(resolvedElement), "Document getElementById found different element");
+        final Element dom2 = decryptedSXO.getDOM();
+        assert dom2 != null;
+        Assert.assertTrue(dom2.isSameNode(resolvedElement), "Document getElementById found different element");
 
         // Verify signature of the decrypted content - this is where bug was reported.
         SignatureValidator.validate(decryptedSignature, signingCredential);
@@ -157,15 +163,17 @@ public class DecryptionSignedContentTest extends XMLObjectBaseTestCase {
      */
     @Test
     public void testPlainRoundTripSignature() throws MarshallingException, UnmarshallingException, SignatureException {
-        Element signedElement = getSignedElement();
+        final Element signedElement = getSignedElement();
 
-        XMLObject xmlObject = unmarshallerFactory.getUnmarshaller(signedElement).unmarshall(signedElement);
+        final XMLObject xmlObject = unmarshallerFactory.ensureUnmarshaller(signedElement).unmarshall(signedElement);
         Assert.assertTrue(xmlObject instanceof SignableSimpleXMLObject);
-        SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) xmlObject;
+        final SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) xmlObject;
 
+        final Signature signature = sxo.getSignature();
+        assert signature != null;
         try {
-            SignatureValidator.validate(sxo.getSignature(), signingCredential);
-        } catch (SignatureException e) {
+            SignatureValidator.validate(signature, signingCredential);
+        } catch (final SignatureException e) {
             Assert.fail("Signature validation failed: " + e);
         }
     }
@@ -178,16 +186,16 @@ public class DecryptionSignedContentTest extends XMLObjectBaseTestCase {
      * @throws MarshallingException ...
      * @throws SignatureException ...
      */
-    private Element getSignedElement() throws MarshallingException, SignatureException {
-        SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) buildXMLObject(SignableSimpleXMLObject.ELEMENT_NAME);
+    @Nonnull private Element getSignedElement() throws MarshallingException, SignatureException {
+        final SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) buildXMLObject(SignableSimpleXMLObject.ELEMENT_NAME);
         sxo.setId(idValue);
 
-        Signature sig = (Signature) buildXMLObject(Signature.DEFAULT_ELEMENT_NAME);
+        final Signature sig = (Signature) buildXMLObject(Signature.DEFAULT_ELEMENT_NAME);
         sig.setSigningCredential(signingCredential);
         sig.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
         sig.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA);
 
-        DocumentInternalIDContentReference contentReference = new DocumentInternalIDContentReference(idValue);
+        final DocumentInternalIDContentReference contentReference = new DocumentInternalIDContentReference(idValue);
         contentReference.getTransforms().add(SignatureConstants.TRANSFORM_ENVELOPED_SIGNATURE);
         contentReference.getTransforms().add(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
         contentReference.setDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA1);
@@ -195,8 +203,8 @@ public class DecryptionSignedContentTest extends XMLObjectBaseTestCase {
 
         sxo.setSignature(sig);
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
-        Element signedElement = marshaller.marshall(sxo);
+        final Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
+        final Element signedElement = marshaller.marshall(sxo);
 
         Signer.signObject(sig);
         return signedElement;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DefaultPreDecryptionValidatorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DefaultPreDecryptionValidatorTest.java
index 8c7f27b54..1dfeaa9f4 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DefaultPreDecryptionValidatorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DefaultPreDecryptionValidatorTest.java
@@ -28,9 +28,7 @@ import org.opensaml.xmlsec.encryption.support.PreDecryptionValidationException;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DefaultPreDecryptionValidatorTest extends XMLObjectBaseTestCase {
     
     private DefaultPreDecryptionValidator validator;
@@ -67,14 +65,18 @@ public class DefaultPreDecryptionValidatorTest extends XMLObjectBaseTestCase {
 
     @Test(expectedExceptions=PreDecryptionValidationException.class)
     public void encryptedDataWithCipherReference() throws Exception {
-        encryptedData.getCipherData().setCipherReference((CipherReference) XMLObjectSupport.buildXMLObject(CipherReference.DEFAULT_ELEMENT_NAME));
+        final CipherData cdata = encryptedData.getCipherData();
+        assert cdata != null;
+        cdata.setCipherReference((CipherReference) XMLObjectSupport.buildXMLObject(CipherReference.DEFAULT_ELEMENT_NAME));
         validator.validate(encryptedData); 
     }
 
     @Test(expectedExceptions=PreDecryptionValidationException.class)
     public void encryptedKeyWithCipherReference() throws Exception {
-        encryptedKey.getCipherData().setCipherReference((CipherReference) XMLObjectSupport.buildXMLObject(CipherReference.DEFAULT_ELEMENT_NAME));
+        final CipherData cdata = encryptedKey.getCipherData();
+        assert cdata != null;
+        cdata.setCipherReference((CipherReference) XMLObjectSupport.buildXMLObject(CipherReference.DEFAULT_ELEMENT_NAME));
         validator.validate(encryptedKey); 
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ECDHTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ECDHTest.java
index a80ea657a..601ad3918 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ECDHTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/ECDHTest.java
@@ -72,9 +72,7 @@ import org.w3c.dom.Element;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.xml.SerializeSupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class ECDHTest extends XMLObjectBaseTestCase {
     
     private String targetFile;
@@ -180,7 +178,7 @@ public class ECDHTest extends XMLObjectBaseTestCase {
         SignableSimpleXMLObject sxoOrig = (SignableSimpleXMLObject) unmarshallElement(targetFile);
         
         EncryptionParameters encParams = encParamsResolver.resolveSingle(encCriteria);
-        Assert.assertNotNull(encParams);
+        assert encParams != null;
         
         DataEncryptionParameters dataEncParams = new DataEncryptionParameters(encParams);
         List<KeyEncryptionParameters> kekParams = encParams.getKeyTransportEncryptionCredential() != null ?
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/EncryptionClonedContentTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/EncryptionClonedContentTest.java
index 4f65c0142..b1929ed53 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/EncryptionClonedContentTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/EncryptionClonedContentTest.java
@@ -32,9 +32,7 @@ import org.opensaml.xmlsec.mock.SignableSimpleXMLObject;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EncryptionClonedContentTest extends XMLObjectBaseTestCase {
     
     private String targetFile;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java
index ecdb0bfa0..dc854ec10 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java
@@ -46,7 +46,6 @@ import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.opensaml.xmlsec.encryption.support.EncryptionException;
 import org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver;
 import org.opensaml.xmlsec.encryption.support.KeyEncryptionParameters;
-import org.opensaml.xmlsec.encryption.support.PreDecryptionValidationException;
 import org.opensaml.xmlsec.encryption.support.RSAOAEPParameters;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java
index 4e4531ac1..7df9d707d 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.xmlsec.impl;
 
+import static org.testng.Assert.assertNull;
+
 import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
@@ -201,9 +203,9 @@ public class BasicDecryptionParametersResolverTest {
         Assert.assertTrue(params.getExcludedAlgorithms().contains("bar"));
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
+    @Test
     public void testNullCriteriaSet() throws ResolverException {
-        resolver.resolve(null);
+        assertNull(resolver.resolveSingle(null));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
index c4e4bbe6f..0e7fc28c5 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
@@ -704,9 +704,9 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         assertTrue(resolver.resolveKeyTransportAlgorithmPredicate(criteriaSet) == predicate);
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
+    @Test
     public void testNullCriteriaSet() throws ResolverException {
-        resolver.resolve(null);
+        assertNull(resolver.resolveSingle(null));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
index d26bbad6b..44f1ed47b 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
@@ -471,9 +471,9 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         assertNull(params);
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
+    @Test
     public void testNullCriteriaSet() throws ResolverException {
-        resolver.resolve(null);
+        assertNull(resolver.resolveSingle(null));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java
index 62de57da3..6723abfaf 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java
@@ -140,9 +140,9 @@ public class BasicSignatureValidationParametersResolverTest {
         assertTrue(params.getExcludedAlgorithms().contains("bar"));
     }
 
-    @Test(expectedExceptions=ConstraintViolationException.class)
+    @Test
     public void testNullCriteriaSet() throws ResolverException {
-        resolver.resolve(null);
+        assertNull(resolver.resolveSingle(null));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/AgreementMethodTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/AgreementMethodTest.java
index ba896e5c2..af1a704e9 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/AgreementMethodTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/AgreementMethodTest.java
@@ -22,13 +22,15 @@ import java.security.spec.ECGenParameterSpec;
 import java.util.ArrayList;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.crypto.SecretKey;
 import javax.xml.namespace.QName;
 
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
+import org.opensaml.core.xml.XMLObject;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.security.credential.CredentialContextSet;
 import org.opensaml.security.credential.CredentialSupport;
 import org.opensaml.security.credential.impl.CollectionCredentialResolver;
 import org.opensaml.security.crypto.JCAConstants;
@@ -36,18 +38,16 @@ import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.agreement.KeyAgreementCredential;
 import org.opensaml.xmlsec.agreement.KeyAgreementParameters;
 import org.opensaml.xmlsec.agreement.impl.ECDHKeyAgreementProcessor;
-import org.opensaml.xmlsec.agreement.impl.PrivateCredential;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
-import org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap;
 import org.opensaml.xmlsec.derivation.impl.ConcatKDF;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedType;
 import org.opensaml.xmlsec.encryption.EncryptionMethod;
 import org.opensaml.xmlsec.encryption.KeySize;
+import org.opensaml.xmlsec.encryption.OriginatorKeyInfo;
+import org.opensaml.xmlsec.encryption.RecipientKeyInfo;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
-import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager;
-import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 import org.opensaml.xmlsec.keyinfo.impl.provider.AgreementMethodKeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.DEREncodedKeyValueProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider;
@@ -61,14 +61,11 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 import com.google.common.collect.Iterables;
-import com.google.common.collect.Lists;
 
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     private LocalKeyInfoCredentialResolver resolver;
@@ -156,7 +153,8 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
         
         // Parameters
         Assert.assertTrue(keyAgreementCred.getParameters().contains(ConcatKDF.class));
-        ConcatKDF kdf = keyAgreementCred.getParameters().get(ConcatKDF.class);
+        final ConcatKDF kdf = keyAgreementCred.getParameters().get(ConcatKDF.class);
+        assert kdf != null;
         Assert.assertEquals(kdf.getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
         Assert.assertEquals(kdf.getAlgorithmID(), "AA");
         Assert.assertEquals(kdf.getPartyUInfo(), "BB");
@@ -164,17 +162,20 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
         Assert.assertEquals(kdf.getSuppPubInfo(), "DD");
         Assert.assertEquals(kdf.getSuppPrivInfo(), "EE");
         
-        Assert.assertTrue(keyAgreementCred.getCredentialContextSet().contains(KeyInfoCredentialContext.class));
-        Assert.assertSame(keyAgreementCred.getCredentialContextSet().get(KeyInfoCredentialContext.class).getKeyInfo(), keyInfo);
+        final CredentialContextSet ctx = keyAgreementCred.getCredentialContextSet();
+        assert ctx != null;
+        final KeyInfoCredentialContext keyInfoCtx = ctx.get(KeyInfoCredentialContext.class);
+        assert keyInfoCtx != null;
+        Assert.assertSame(keyInfoCtx.getKeyInfo(), keyInfo);
     }
     
     @Test
     public void agreementAlgorithmNotRegistered() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
         keyInfo.getAgreementMethods().get(0).setAlgorithm("INVALID");
         
-        Iterable<Credential> creds = resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
+        final Iterable<Credential> creds = resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
         
         Assert.assertNotNull(creds);
         Assert.assertEquals(Iterables.size(creds), 0);
@@ -182,11 +183,11 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     @Test
     public void agreementMethodNotGranndchildOfEncryptedType() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
         keyInfo.setParent(null);
         
-        Iterable<Credential> creds = resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
+        final Iterable<Credential> creds = resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
         
         Assert.assertNotNull(creds);
         Assert.assertEquals(Iterables.size(creds), 0);
@@ -194,25 +195,28 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     @Test(expectedExceptions = ResolverException.class)
     public void missingEncryptionAlgorithm() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
-        
-        EncryptedType.class.cast(keyInfo.getParent()).getEncryptionMethod().setAlgorithm(null);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final EncryptionMethod method = EncryptedType.class.cast(keyInfo.getParent()).getEncryptionMethod(); 
+        assert method != null;
+        method.setAlgorithm(null);
         
         resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
     }
     
     @Test(expectedExceptions = ResolverException.class)
     public void unknownEncryptionAlgorithm() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
-        EncryptedType.class.cast(keyInfo.getParent()).getEncryptionMethod().setAlgorithm("INVALID");
+        final EncryptionMethod method = EncryptedType.class.cast(keyInfo.getParent()).getEncryptionMethod(); 
+        assert method != null;
+        method.setAlgorithm("INVALID");
         
         resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
     }
     
     @Test(expectedExceptions = ResolverException.class)
     public void missingOriginatorKeyInfo() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
         keyInfo.getAgreementMethods().get(0).setOriginatorKeyInfo(null);
         
@@ -221,17 +225,19 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     @Test(expectedExceptions = ResolverException.class)
     public void originatorCredResolutionFailedMissingKeyInfoData() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final OriginatorKeyInfo oki = keyInfo.getAgreementMethods().get(0).getOriginatorKeyInfo();
+        assert oki != null;
         
-        keyInfo.getAgreementMethods().get(0).getOriginatorKeyInfo().getDEREncodedKeyValues().clear();
-        keyInfo.getAgreementMethods().get(0).getOriginatorKeyInfo().getKeyValues().clear();
+        oki.getDEREncodedKeyValues().clear();
+        oki.getKeyValues().clear();
         
         resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
     }
     
     @Test(expectedExceptions = ResolverException.class)
     public void missingRecipientKeyInfo() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
         keyInfo.getAgreementMethods().get(0).setRecipientKeyInfo(null);
         
@@ -240,10 +246,12 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     @Test(expectedExceptions = ResolverException.class)
     public void recipientCredResolutionFailedMissingKeyInfoData() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final RecipientKeyInfo rki = keyInfo.getAgreementMethods().get(0).getRecipientKeyInfo(); 
+        assert rki != null;
         
-        keyInfo.getAgreementMethods().get(0).getRecipientKeyInfo().getDEREncodedKeyValues().clear();
-        keyInfo.getAgreementMethods().get(0).getRecipientKeyInfo().getKeyValues().clear();
+        rki.getDEREncodedKeyValues().clear();
+        rki.getKeyValues().clear();
         
         resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
     }
@@ -251,7 +259,7 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     @Test(expectedExceptions = ResolverException.class)
     public void recipientCredResolutionFailedAtCredentialResolver() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
         recipientLocalCredResolver.getCollection().clear();
         
@@ -260,7 +268,7 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
     
     @Test(expectedExceptions = ResolverException.class)
     public void recipientCredMissingPrivateKey() throws Exception {
-        KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
+        final KeyInfo keyInfo = prepareAndValidateKeyInfo(credKeyAgreementOriginatorEC);
         
         recipientLocalCredResolver.getCollection().clear();
         recipientLocalCredResolver.getCollection().add(credRecipientPublicEC);
@@ -268,22 +276,22 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
         resolver.resolve(new CriteriaSet(new KeyInfoCriterion(keyInfo)));
     }
     
-    
-    
     //
     // Helpers
     //
     
-    private KeyInfo prepareAndValidateKeyInfo(KeyAgreementCredential cred) throws SecurityException {
+    @Nonnull private KeyInfo prepareAndValidateKeyInfo(KeyAgreementCredential cred) throws SecurityException {
         KeyInfo keyInfo = keyInfoFactory.newInstance().generate(credKeyAgreementOriginatorEC);
-        Assert.assertNotNull(keyInfo);
-        Assert.assertEquals(keyInfo.getOrderedChildren().size(), 1);
+        assert keyInfo != null;
+        final List<XMLObject> children = keyInfo.getOrderedChildren();
+        assert children != null;
+        Assert.assertEquals(children.size(), 1);
         Assert.assertEquals(keyInfo.getAgreementMethods().size(), 1);
         makeEncryptionMethodChild(keyInfo, expectedEncryptionAlgorithm, null, EncryptedData.DEFAULT_ELEMENT_NAME); 
         return keyInfo;
     }
     
-    private EncryptedType makeEncryptionMethodChild(KeyInfo keyinfo, String algorithm, Integer keySize, QName elementType) {
+    @Nonnull private EncryptedType makeEncryptionMethodChild(KeyInfo keyinfo, String algorithm, Integer keySize, QName elementType) {
         EncryptedType encryptedType = buildXMLObject(elementType);
         encryptedType.setKeyInfo(keyinfo);
         
@@ -298,11 +306,12 @@ public class AgreementMethodTest extends XMLObjectBaseTestCase {
         return encryptedType;
     }
     
-    private void validateDerivedKey(Credential credential, String algorithmURI) {
-        Assert.assertNotNull(credential);
+    private void validateDerivedKey(@Nonnull final Credential credential, @Nonnull final String algorithmURI) {
         Assert.assertNotNull(credential.getSecretKey());
-        Assert.assertEquals(credential.getSecretKey().getAlgorithm(), AlgorithmSupport.getKeyAlgorithm(algorithmURI));
-        Assert.assertEquals(KeySupport.getKeyLength(credential.getSecretKey()), AlgorithmSupport.getKeyLength(algorithmURI));
+        final SecretKey skey = credential.getSecretKey();
+        assert skey != null;
+        Assert.assertEquals(skey.getAlgorithm(), AlgorithmSupport.getKeyAlgorithm(algorithmURI));
+        Assert.assertEquals(KeySupport.getKeyLength(skey), AlgorithmSupport.getKeyLength(algorithmURI));
     }
 
 }
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java
index 90039883c..0f5a0ed89 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java
@@ -100,7 +100,7 @@ public class BasicKeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
         
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         
         Assert.assertEquals(keyInfo.getOrderedChildren().size(), 2, "Unexpected number of KeyInfo children");
@@ -125,7 +125,7 @@ public class BasicKeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
         
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         
         Assert.assertEquals(keyInfo.getKeyNames().size(), 2, "Unexpected number of KeyName elements");
@@ -146,7 +146,7 @@ public class BasicKeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
         
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         
         Assert.assertEquals(keyInfo.getKeyNames().size(), 1, "Unexpected number of KeyName elements");
@@ -180,7 +180,7 @@ public class BasicKeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         keyInfo = generator.generate(credential);
         
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         Assert.assertEquals(keyInfo.getOrderedChildren().size(), 5, "Unexpected # of KeyInfo children found");
     }
@@ -210,7 +210,7 @@ public class BasicKeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         
         Assert.assertTrue(type.isInstance(keyInfo));
         
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         
         Assert.assertEquals(keyInfo.getOrderedChildren().size(), 2, "Unexpected number of KeyInfo children");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java
index 05b904c37..1ebdd5516 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java
@@ -140,6 +140,8 @@ public class NamedKeyInfoGeneratorManagerTest extends XMLObjectBaseTestCase {
         
         Assert.assertFalse(names.contains("BAZ"), "Non-existent manager name found in name set");
         Assert.assertNotNull(manager.getManager("BAZ"), "Failed to create new manager");
+        
+        names = manager.getManagerNames();
         Assert.assertTrue(names.contains("BAZ"), "Expected manager name not found");
     }
     
@@ -158,6 +160,7 @@ public class NamedKeyInfoGeneratorManagerTest extends XMLObjectBaseTestCase {
         Assert.assertTrue(names.contains(nameBar), "Expected manager name not found");
         
         manager.removeManager(nameFoo);
+        names = manager.getManagerNames();
         Assert.assertEquals(names.size(), 1, "Unexpected # of manager names");
         Assert.assertNotNull(manager.getManager(nameBar), "Failed to find manager by name");
         Assert.assertFalse(names.contains(nameFoo), "Unexpected manager name found");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java
index 3a33ad207..887a05e06 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java
@@ -216,7 +216,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getOrderedChildren().size(), 1, "Unexpected number of KeyInfo children");
@@ -237,7 +237,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getKeyNames().size(), 2, "Unexpected number of KeyName elements");
@@ -279,7 +279,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -302,7 +302,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -327,7 +327,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -351,7 +351,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -373,7 +373,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -395,7 +395,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -423,7 +423,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -448,7 +448,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
         
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         
         Assert.assertEquals(keyInfo.getX509Datas().size(), 1, "Unexpected number of X509Data elements");
@@ -472,7 +472,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getKeyNames().size(), 1, "Unexpected number of KeyName elements");
@@ -493,7 +493,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getKeyNames().size(), 1, "Unexpected number of KeyName elements");
@@ -527,7 +527,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getKeyNames().size(), 1, "Unexpected number of KeyName elements");
@@ -540,7 +540,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getKeyNames().size(), 3, "Unexpected number of KeyName elements");
@@ -569,7 +569,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
 
         Assert.assertEquals(keyInfo.getKeyNames().size(), 7, "Unexpected number of KeyName elements");
@@ -607,7 +607,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance();
         keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         Assert.assertEquals(keyInfo.getOrderedChildren().size(), 4, "Unexpected # of KeyInfo children found");
     }
@@ -634,7 +634,7 @@ public class X509KeyInfoGeneratorTest extends XMLObjectBaseTestCase {
         generator = factory.newInstance(type);
         KeyInfo keyInfo = generator.generate(credential);
 
-        Assert.assertNotNull(keyInfo, "Generated KeyInfo was null");
+        assert keyInfo != null;
         Assert.assertNotNull(keyInfo.getOrderedChildren(), "Generated KeyInfo children list was null");
         
         Assert.assertTrue(type.isInstance(keyInfo));
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/tests/KeyInfoSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/tests/KeyInfoSupportTest.java
index 4655b49a7..d23f71db3 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/tests/KeyInfoSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/tests/KeyInfoSupportTest.java
@@ -377,36 +377,21 @@ public class KeyInfoSupportTest extends XMLObjectBaseTestCase {
      */
     @Test
     public void testCertConversionXMLtoJava() throws CertificateException {
-        java.security.cert.X509Certificate javaCert = null;
-        try {
-            javaCert = KeyInfoSupport.getCertificate(xmlCert1);
-        } catch (CertificateException e) {
-            Assert.fail("Conversion from XML X509Certificate format to java.security.cert.X509Certificate failed: " + e);
-        }
-        Assert.assertNotNull(javaCert, "Cert1 was null, failed to convert from XML to Java representation");
+        java.security.cert.X509Certificate javaCert = KeyInfoSupport.getCertificate(xmlCert1);
+        assert javaCert != null;
         Assert.assertEquals(javaCert.getSubjectX500Principal().getName(X500Principal.RFC2253), cert1SubjectDN,
                 "Cert1 SubjectDN");
         Assert.assertEquals(javaCert, X509Support.decodeCertificate(xmlCert1.getValue()),
                 "Java cert was not the expected value");
 
-        List<java.security.cert.X509Certificate> javaCertList = null;
-
-        try {
-            javaCertList = KeyInfoSupport.getCertificates(xmlX509Data);
-        } catch (CertificateException e) {
-            Assert.fail("Obtaining certs from X509Data failed: " + e);
-        }
+        List<java.security.cert.X509Certificate> javaCertList = KeyInfoSupport.getCertificates(xmlX509Data);
         Assert.assertEquals(javaCertList.size(), numExpectedCerts, "# of certs returned");
         Assert.assertEquals(javaCertList.get(0).getSubjectX500Principal().getName(X500Principal.RFC2253), cert1SubjectDN,
                 "Cert1 SubjectDN");
         Assert.assertEquals(javaCertList.get(1).getSubjectX500Principal().getName(X500Principal.RFC2253), cert2SubjectDN,
                 "Cert2 SubjectDN");
 
-        try {
-            javaCertList = KeyInfoSupport.getCertificates(keyInfo);
-        } catch (CertificateException e) {
-            Assert.fail("Obtaining certs from KeyInfo failed: " + e);
-        }
+        javaCertList = KeyInfoSupport.getCertificates(keyInfo);
         Assert.assertEquals(javaCertList.size(), numExpectedCerts, "# of certs returned");
         Assert.assertEquals(javaCertList.get(0).getSubjectX500Principal().getName(X500Principal.RFC2253), cert1SubjectDN,
                 "Cert1 SubjectDN");
@@ -422,37 +407,22 @@ public class KeyInfoSupportTest extends XMLObjectBaseTestCase {
      */
     @Test
     public void testCRLConversionXMLtoJava() throws CertificateException, CRLException {
-        java.security.cert.X509CRL javaCRL = null;
-        try {
-            javaCRL = KeyInfoSupport.getCRL(xmlCRL1);
-        } catch (CRLException e) {
-            Assert.fail("Conversion from XML X509CRL format to java.security.cert.X509CRL failed: " + e);
-        }
-        Assert.assertNotNull(javaCRL, "CRL was null, failed to convert from XML to Java representation");
+        final java.security.cert.X509CRL javaCRL = KeyInfoSupport.getCRL(xmlCRL1);
+        assert javaCRL != null;
         Assert.assertEquals(javaCRL.getIssuerX500Principal().getName(X500Principal.RFC2253), crl1IssuerDN, "CRL IssuerDN");
         Assert.assertEquals(javaCRL, X509Support.decodeCRL(xmlCRL1.getValue()),
                 "Java CRL was not the expected value");
 
-        List<java.security.cert.X509CRL> javaCRLList = null;
+        List<java.security.cert.X509CRL> javaCRLList = KeyInfoSupport.getCRLs(xmlX509Data);
 
-        try {
-            javaCRLList = KeyInfoSupport.getCRLs(xmlX509Data);
-        } catch (CRLException e) {
-            Assert.fail("Obtaining CRLs from X509Data failed: " + e);
-        }
         Assert.assertEquals(javaCRLList.size(), numExpectedCRLs, "# of CRLs returned");
         Assert.assertEquals(javaCRLList.get(0).getIssuerX500Principal().getName(X500Principal.RFC2253), crl1IssuerDN,
                 "CRL IssuerDN");
 
-        try {
-            javaCRLList = KeyInfoSupport.getCRLs(keyInfo);
-        } catch (CRLException e) {
-            Assert.fail("Obtaining CRLs from KeInfo failed: " + e);
-        }
+        javaCRLList = KeyInfoSupport.getCRLs(keyInfo);
         Assert.assertEquals(javaCRLList.size(), numExpectedCRLs, "# of CRLs returned");
         Assert.assertEquals(javaCRLList.get(0).getIssuerX500Principal().getName(X500Principal.RFC2253), crl1IssuerDN,
                 "CRL IssuerDN");
-
     }
 
     /**
@@ -462,13 +432,7 @@ public class KeyInfoSupportTest extends XMLObjectBaseTestCase {
      */
     @Test
     public void testCertConversionJavaToXML() throws CertificateException {
-        X509Certificate xmlCert = null;
-        try {
-            xmlCert = KeyInfoSupport.buildX509Certificate(javaCert1);
-        } catch (CertificateEncodingException e) {
-            Assert.fail("Conversion from Java X509Certificate to XMLObject failed: " + e);
-        }
-
+        final X509Certificate xmlCert = KeyInfoSupport.buildX509Certificate(javaCert1);
         Assert.assertEquals(X509Support.decodeCertificate(xmlCert.getValue()), javaCert1,
                 "Java X509Certificate encoding to XMLObject failed");
     }
@@ -481,13 +445,7 @@ public class KeyInfoSupportTest extends XMLObjectBaseTestCase {
      */
     @Test
     public void testCRLConversionJavaToXML() throws CertificateException, CRLException {
-        X509CRL xmlCRL = null;
-        try {
-            xmlCRL = KeyInfoSupport.buildX509CRL(javaCRL1);
-        } catch (CRLException e) {
-            Assert.fail("Conversion from Java X509CRL to XMLObject failed: " + e);
-        }
-
+        final X509CRL xmlCRL = KeyInfoSupport.buildX509CRL(javaCRL1);
         Assert.assertEquals(X509Support.decodeCRL(xmlCRL.getValue()), javaCRL1,
                 "Java X509CRL encoding to XMLObject failed");
     }
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandlerTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandlerTest.java
index 8feba48fd..eba48bd4e 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandlerTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandlerTest.java
@@ -17,7 +17,8 @@
 
 package org.opensaml.xmlsec.messaging.impl;
 
-import java.util.Collections;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
@@ -30,13 +31,14 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
 /** Unit test for {@link PopulateSignatureValidationParametersHandler}. */
+ at SuppressWarnings("javadoc")
 public class PopulateSignatureValidationParametersHandlerTest extends OpenSAMLInitBaseTestCase {
 
     private MessageContext messageContext;
@@ -53,14 +55,6 @@ public class PopulateSignatureValidationParametersHandlerTest extends OpenSAMLIn
         handler.initialize();
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
-    public void testNoContext() throws Exception {
-        handler.setSignatureValidationParametersResolver(new MockResolver(false));
-        handler.initialize();
-        
-        handler.invoke(null);
-    }
-    
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testResolverError() throws Exception {
         handler.setSignatureValidationParametersResolver(new MockResolver(true));
@@ -74,7 +68,7 @@ public class PopulateSignatureValidationParametersHandlerTest extends OpenSAMLIn
         handler.initialize();
         
         handler.invoke(messageContext);
-        Assert.assertNotNull(messageContext.getSubcontext(SecurityParametersContext.class).getSignatureValidationParameters());
+        Assert.assertNotNull(messageContext.ensureSubcontext(SecurityParametersContext.class).getSignatureValidationParameters());
     }    
     
     private class MockResolver implements SignatureValidationParametersResolver {
@@ -86,18 +80,21 @@ public class PopulateSignatureValidationParametersHandlerTest extends OpenSAMLIn
         }
         
         /** {@inheritDoc} */
-        @Override
-        public Iterable<SignatureValidationParameters> resolve(CriteriaSet criteria) throws ResolverException {
-            return Collections.singletonList(resolveSingle(criteria));
+        @Nonnull public Iterable<SignatureValidationParameters> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+            final var params = resolveSingle(criteria);
+            if (params != null) {
+                return CollectionSupport.singletonList(params);
+            }
+            return CollectionSupport.emptyList();
         }
 
         /** {@inheritDoc} */
-        @Override
-        public SignatureValidationParameters resolveSingle(CriteriaSet criteria) throws ResolverException {
+        @Nullable public SignatureValidationParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
             if (throwException) {
                 throw new ResolverException();
             }
             
+            assert criteria != null;
             Constraint.isNotNull(criteria.get(SignatureValidationConfigurationCriterion.class), "Criterion was null");
             return new SignatureValidationParameters();
         }
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java
index 747c5e8bb..eb952783a 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java
@@ -24,6 +24,8 @@ import java.util.Collections;
 import java.util.LinkedList;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
@@ -42,40 +44,40 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
     //TODO these and other supporting classes need to be refactored
     
     /** Default namespace */
-    public final static String NAMESPACE = "http://www.example.org/testObjects";
+    @Nonnull public final static String NAMESPACE = "http://www.example.org/testObjects";
     
     /** Default namespace prefix */
-    public final static String NAMESPACE_PREFIX = "test";
+    @Nonnull public final static String NAMESPACE_PREFIX = "test";
     
     /** Element local name */
-    public final static String LOCAL_NAME = "SignableSimpleElement";
+    @Nonnull public final static String LOCAL_NAME = "SignableSimpleElement";
     
     /** Default element name */
-    public final static QName ELEMENT_NAME = new QName(NAMESPACE, LOCAL_NAME, NAMESPACE_PREFIX);
+    @Nonnull public final static QName ELEMENT_NAME = new QName(NAMESPACE, LOCAL_NAME, NAMESPACE_PREFIX);
     
     /** Local name of encrypted element */
-    public final static String ENCRYPTED_NAME = "Encrypted" + LOCAL_NAME;
+    @Nonnull public final static String ENCRYPTED_NAME = "Encrypted" + LOCAL_NAME;
     
     /** Name attribute name */
-    public final static String ID_ATTRIB_NAME = "Id";
+    @Nonnull public final static String ID_ATTRIB_NAME = "Id";
     
     /** Name attribute */
-    private String id;
+    @Nullable private String id;
     
     /** Value of the object stored as text content in the element */
-    private String value;
+    @Nullable private String value;
     
     /** Child SimpleXMLObjects */
-    private XMLObjectChildrenList<SignableSimpleXMLObject> simpleXMLObjects;
+    @Nonnull private XMLObjectChildrenList<SignableSimpleXMLObject> simpleXMLObjects;
     
     /** Other children */
-    private IndexedXMLObjectChildrenList<XMLObject> unknownXMLObjects;
+    @Nonnull private IndexedXMLObjectChildrenList<XMLObject> unknownXMLObjects;
     
     /** EncryptedData child */
-    private EncryptedData encryptedData;
+    @Nullable private EncryptedData encryptedData;
     
     /** anyAttribute wildcard attributes. */
-    private AttributeMap unknownAttributes;
+    @Nonnull private AttributeMap unknownAttributes;
     
     /**
      * Constructor
@@ -83,7 +85,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * @param localName ...
      * @param namespacePrefix ...
      */
-    public SignableSimpleXMLObject(String namspaceURI, String localName, String namespacePrefix) {
+    public SignableSimpleXMLObject(@Nullable String namspaceURI, @Nonnull String localName, @Nullable String namespacePrefix) {
         super(namspaceURI, localName, namespacePrefix);
         
         simpleXMLObjects = new XMLObjectChildrenList<>(this);
@@ -96,7 +98,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * 
      * @return the name attribute
      */
-    public String getId() {
+    @Nullable public String getId() {
         return id;
     }
     
@@ -105,7 +107,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * 
      * @param newId the name attribute
      */
-    public void setId(String newId) {
+    public void setId(@Nullable final String newId) {
         registerOwnID(id, newId);
         id = newId;
     }
@@ -115,7 +117,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * 
      * @return the value of this object
      */
-    public String getValue(){
+    @Nullable public String getValue() {
         return value;
     }
     
@@ -124,7 +126,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * 
      * @param newValue the value of this object
      */
-    public void setValue(String newValue){
+    public void setValue(@Nullable final String newValue) {
         value = prepareForAssignment(value, newValue);
     }
     
@@ -133,7 +135,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * 
      * @return the EncryptedData child element
      */
-    public EncryptedData getEncryptedData() {
+    @Nullable public EncryptedData getEncryptedData() {
        return this.encryptedData;
     }
     
@@ -142,7 +144,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
      * 
      * @param newEncryptedData the new EncryptedData child element
      */
-    public void setEncryptedData(EncryptedData newEncryptedData) {
+    public void setEncryptedData(@Nullable final EncryptedData newEncryptedData) {
         this.encryptedData = prepareForAssignment(this.encryptedData, newEncryptedData);
     }
     
@@ -156,17 +158,18 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
     }
     
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull public List<XMLObject> getUnknownXMLObjects() {
         return unknownXMLObjects;
     }
     
     /** {@inheritDoc} */
-    public List<XMLObject> getUnknownXMLObjects(QName typeOrName) {
+    @SuppressWarnings("unchecked")
+    @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownXMLObjects.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable public List<XMLObject> getOrderedChildren() {
         List<XMLObject> children = new LinkedList<>();
         
         children.addAll(simpleXMLObjects);
@@ -180,7 +183,7 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
     }
 
     /** {@inheritDoc} */
-    public AttributeMap getUnknownAttributes() {
+    @Nonnull public AttributeMap getUnknownAttributes() {
         return unknownAttributes;
     }
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObjectBuilder.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObjectBuilder.java
index f3ce98fd3..142ef7e36 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObjectBuilder.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObjectBuilder.java
@@ -21,6 +21,9 @@
 
 package org.opensaml.xmlsec.mock;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 
 /**
@@ -28,12 +31,13 @@ import org.opensaml.core.xml.AbstractXMLObjectBuilder;
  */
 public class SignableSimpleXMLObjectBuilder extends AbstractXMLObjectBuilder<SignableSimpleXMLObject> {
     
-    public SignableSimpleXMLObject buildObject(){
+    @Nonnull public SignableSimpleXMLObject buildObject(){
         return buildObject(SignableSimpleXMLObject.NAMESPACE, SignableSimpleXMLObject.LOCAL_NAME, SignableSimpleXMLObject.NAMESPACE_PREFIX);
     }
 
     /** {@inheritDoc} */
-    public SignableSimpleXMLObject buildObject(String namespaceURI, String localName, String namespacePrefix) {
+    @Nonnull public SignableSimpleXMLObject buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new SignableSimpleXMLObject(namespaceURI, localName, namespacePrefix);
     }
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngineTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngineTest.java
index 61b7276ca..c22916a37 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngineTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ChainingSignatureTrustEngineTest.java
@@ -37,9 +37,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class ChainingSignatureTrustEngineTest extends XMLObjectBaseTestCase {
 
     private CriteriaSet criteriaSet;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java
index e8c0fd9a4..5ecc9e848 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java
@@ -67,6 +67,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 /**
  * Tests the {@link PKIXSignatureTrustEngine} implementation.
  */
+ at SuppressWarnings("javadoc")
 public class PKIXSignatureTrustEngineTest extends XMLObjectBaseTestCase {
     
     private static final String DATA_PATH = "/org/opensaml/xmlsec/signature/support/";
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/DetachedSignatureTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/DetachedSignatureTest.java
index 308930e57..da450bb45 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/DetachedSignatureTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/DetachedSignatureTest.java
@@ -51,6 +51,7 @@ import net.shibboleth.shared.testing.RepositorySupport;
 import net.shibboleth.shared.xml.SerializeSupport;
 import net.shibboleth.shared.xml.impl.BasicParserPool;
 
+ at SuppressWarnings("javadoc")
 public class DetachedSignatureTest extends XMLObjectBaseTestCase {
 
     /** Class logger. */
@@ -103,15 +104,16 @@ public class DetachedSignatureTest extends XMLObjectBaseTestCase {
         SignableSimpleXMLObject sxo = getXMLObjectWithSignature();
         Signature signature = sxo.getSignature();
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
         Element signedElement = marshaller.marshall(sxo);
 
+        assert signature != null;
         Signer.signObject(signature);
         if (log.isDebugEnabled()) {
             log.debug("Marshalled deatched Signature: \n" + SerializeSupport.nodeToString(signedElement));
         }
 
-        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(signedElement);
+        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().ensureUnmarshaller(signedElement);
         sxo = (SignableSimpleXMLObject) unmarshaller.unmarshall(signedElement);
         signature = (Signature) sxo.getOrderedChildren().get(1);
 
@@ -150,7 +152,7 @@ public class DetachedSignatureTest extends XMLObjectBaseTestCase {
         contentReference.setDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA1);
         signature.getContentReferences().add(contentReference);
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(signature);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(signature);
         Element signatureElement = marshaller.marshall(signature);
 
         Signer.signObject(signature);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureTest.java
index 8254b960c..a7b9da143 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureTest.java
@@ -102,9 +102,10 @@ public class EnvelopedSignatureTest extends XMLObjectBaseTestCase {
         SignableSimpleXMLObject sxo = getXMLObjectWithSignature();
         Signature signature = sxo.getSignature();
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
         Element signedElement = marshaller.marshall(sxo);
         
+        assert signature != null;
         Signer.signObject(signature);
         
         if (log.isDebugEnabled()) {
@@ -135,13 +136,13 @@ public class EnvelopedSignatureTest extends XMLObjectBaseTestCase {
         Document envelopedSignatureDoc = parserPool.parse(ins);
         Element rootElement = envelopedSignatureDoc.getDocumentElement();
 
-        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(rootElement);
+        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().ensureUnmarshaller(rootElement);
         SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) unmarshaller.unmarshall(rootElement);
 
         Assert.assertEquals(sxo.getId(), "FOO", "Id attribute was not expected value");
 
         Signature signature = sxo.getSignature();
-        Assert.assertNotNull(signature, "Signature was null");
+        assert signature != null;
 
         KeyInfo keyInfo = signature.getKeyInfo();
         Assert.assertNotNull(keyInfo, "Signature's KeyInfo was null");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/HMACSignatureTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/HMACSignatureTest.java
index d22acfa60..8d0b987a2 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/HMACSignatureTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/HMACSignatureTest.java
@@ -122,9 +122,10 @@ public class HMACSignatureTest extends XMLObjectBaseTestCase {
         SignableSimpleXMLObject sxo = getXMLObjectWithSignature(false);
         Signature signature = sxo.getSignature();
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
         Element signedElement = marshaller.marshall(sxo);
         
+        assert signature != null;
         Signer.signObject(signature);
         
         if (log.isDebugEnabled()) {
@@ -152,9 +153,10 @@ public class HMACSignatureTest extends XMLObjectBaseTestCase {
         SignableSimpleXMLObject sxo = getXMLObjectWithSignature(true);
         Signature signature = sxo.getSignature();
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
         Element signedElement = marshaller.marshall(sxo);
         
+        assert signature != null;
         Signer.signObject(signature);
         
         if (log.isDebugEnabled()) {
@@ -184,16 +186,16 @@ public class HMACSignatureTest extends XMLObjectBaseTestCase {
         Document envelopedSignatureDoc = parserPool.parse(ins);
         Element rootElement = envelopedSignatureDoc.getDocumentElement();
 
-        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(rootElement);
+        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().ensureUnmarshaller(rootElement);
         SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) unmarshaller.unmarshall(rootElement);
 
         Assert.assertEquals(sxo.getId(), "FOO", "Id attribute was not expected value");
 
         Signature signature = sxo.getSignature();
-        Assert.assertNotNull(signature, "Signature was null");
+        assert signature != null;
 
         KeyInfo keyInfo = signature.getKeyInfo();
-        Assert.assertNotNull(keyInfo, "Signature's KeyInfo was null");
+        assert keyInfo != null;
         
         KeyName keyName = keyInfo.getKeyNames().get(0);
         Assert.assertNotNull(keyName, "KeyName was null");
@@ -216,16 +218,16 @@ public class HMACSignatureTest extends XMLObjectBaseTestCase {
         Document envelopedSignatureDoc = parserPool.parse(ins);
         Element rootElement = envelopedSignatureDoc.getDocumentElement();
 
-        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(rootElement);
+        Unmarshaller unmarshaller = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().ensureUnmarshaller(rootElement);
         SignableSimpleXMLObject sxo = (SignableSimpleXMLObject) unmarshaller.unmarshall(rootElement);
 
         Assert.assertEquals(sxo.getId(), "FOO", "Id attribute was not expected value");
 
         Signature signature = sxo.getSignature();
-        Assert.assertNotNull(signature, "Signature was null");
+        assert signature != null;
 
         KeyInfo keyInfo = signature.getKeyInfo();
-        Assert.assertNotNull(keyInfo, "Signature's KeyInfo was null");
+        assert keyInfo != null;
         
         KeyName keyName = keyInfo.getKeyNames().get(0);
         Assert.assertNotNull(keyName, "KeyName was null");
@@ -245,13 +247,14 @@ public class HMACSignatureTest extends XMLObjectBaseTestCase {
     public void testMarshallNoOutputLength() throws MarshallingException {
         SignableSimpleXMLObject sxo = getXMLObjectWithSignature(false);
         Signature signature = sxo.getSignature();
+        assert signature != null;
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
         marshaller.marshall(sxo);
         
         Assert.assertNotNull(signature.getDOM(), "Signature DOM was null");
         XMLSignature apacheSignature = ((SignatureImpl) signature).getXMLSignature();
-        Assert.assertNotNull(apacheSignature, "Apache XMLSignature was null");
+        assert apacheSignature != null;
         SignedInfo apacheSignedInfo = apacheSignature.getSignedInfo(); 
         Assert.assertNotNull(apacheSignedInfo, "Apache SignedInfo was null");
         Element sigMethodElement = apacheSignedInfo.getSignatureMethodElement();
@@ -269,13 +272,14 @@ public class HMACSignatureTest extends XMLObjectBaseTestCase {
     public void testMarshallWithOutputLength() throws MarshallingException {
         SignableSimpleXMLObject sxo = getXMLObjectWithSignature(true);
         Signature signature = sxo.getSignature();
+        assert signature != null;
 
-        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(sxo);
+        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
         marshaller.marshall(sxo);
         
         Assert.assertNotNull(signature.getDOM(), "Signature DOM was null");
         XMLSignature apacheSignature = ((SignatureImpl) signature).getXMLSignature();
-        Assert.assertNotNull(apacheSignature, "Apache XMLSignature was null");
+        assert apacheSignature != null;
         SignedInfo apacheSignedInfo = apacheSignature.getSignedInfo(); 
         Assert.assertNotNull(apacheSignedInfo, "Apache SignedInfo was null");
         Element sigMethodElement = apacheSignedInfo.getSignatureMethodElement();
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureAlgorithmValidatorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureAlgorithmValidatorTest.java
index b02c9a798..7f74f7e69 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureAlgorithmValidatorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureAlgorithmValidatorTest.java
@@ -33,6 +33,7 @@ import org.testng.annotations.Test;
 /**
  * Test signature algorithm whitelist and blacklist evaluation.
  */
+ at SuppressWarnings("javadoc")
 public class SignatureAlgorithmValidatorTest extends XMLObjectBaseTestCase {
     
     private Signature signature;
@@ -52,6 +53,7 @@ public class SignatureAlgorithmValidatorTest extends XMLObjectBaseTestCase {
         whitelist = new HashSet<>();
         blacklist = new HashSet<>();
         SignableSimpleXMLObject ssxo = unmarshallElement("/org/opensaml/xmlsec/signature/support/envelopedSignature.xml");
+        assert ssxo != null;
         signature = ssxo.getSignature();
     }
     
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureSupportTest.java
index 0fa199454..45e9370d6 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/SignatureSupportTest.java
@@ -30,6 +30,7 @@ import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.SignatureSigningParameters;
 import org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
+import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 import org.opensaml.xmlsec.signature.support.SignatureSupport;
@@ -38,6 +39,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
+ at SuppressWarnings("javadoc")
 public class SignatureSupportTest extends XMLObjectBaseTestCase {
     
     private Credential signingCredential;
@@ -48,8 +50,10 @@ public class SignatureSupportTest extends XMLObjectBaseTestCase {
     public void initializeKeyPairAndGenerator() throws NoSuchAlgorithmException, NoSuchProviderException {
         KeyPair keyPair = KeySupport.generateKeyPair("RSA", 1024, null);
         signingCredential = CredentialSupport.getSimpleCredential(keyPair.getPublic(), keyPair.getPrivate());
-        keyInfoGenerator = DefaultSecurityConfigurationBootstrap.buildBasicKeyInfoGeneratorManager()
-                .getDefaultManager().getFactory(signingCredential).newInstance();
+        final KeyInfoGeneratorFactory factory = DefaultSecurityConfigurationBootstrap.buildBasicKeyInfoGeneratorManager()
+                .getDefaultManager().getFactory(signingCredential);
+        assert factory != null;
+        keyInfoGenerator = factory.newInstance();
     }
     
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list