What I contributed

I added an imported RSA encryption-key provider supporting RSA1_5, RSA-OAEP, and RSA-OAEP-256. The change separated signing and encryption provider configuration while maintaining compatibility with existing imported RSA keys.

The contribution included provider registration and integration tests covering the supported encryption algorithms.

Why it mattered

Deployments could use externally managed RSA keys specifically for encryption, with explicit algorithm support and regression coverage in Keycloak's identity and access-management stack.