Rich consent fetch crashes with Android Keystore RSA private keys

[lucas-heidihealth]

Problem

Guardian.fetchConsent(notification, enrollment) crashes on Android when the enrollment key is backed by Android Keystore and the notification contains a transactionLinkingId.

Observed exception

java.lang.ClassCastException:
  android.security.keystore2.AndroidKeyStoreRSAPrivateKey cannot be cast to
  java.security.interfaces.RSAPrivateKey
at com.auth0.android.guardian.sdk.RichConsentsAPIClient.createProofOfPossessionAssertion(RichConsentsAPIClient.java:84)

The failure occurs before the rich-consent request reaches the network. The SDK casts the PrivateKey to RSAPrivateKey for JWT signing, but Android Keystore returns an AndroidKeyStoreRSAPrivateKey that supports signing through java.security.Signature without implementing the RSA key interface.

Expected behavior

fetchConsent should sign the DPoP assertion using the PrivateKey abstraction, as the existing allow/reject signing path does, and return either the consent details or a normal GuardianException.

Reproduction

1. Use an enrollment whose key is generated in Android Keystore.
2. Receive a push notification with a non-null transactionLinkingId.
3. Call guardian.fetchConsent(notification, enrollment).

The crash was reproduced in Heidi Android using auth0-guardian 0.10.1 and remains reproducible with 0.11.0.

I have prepared a pull request replacing the concrete key cast with JCA SHA256withRSA signing.