fun signXades(sourceDoc: Document) {
    val factory = XPathFactory.newInstance()
    val xpath = factory.newXPath()
    val expr = xpath.compile(String.format("//*[@Id='%s']", "request"))
    val nodes = expr.evaluate(sourceDoc, XPathConstants.NODESET) as NodeList
    val nodeToSign = nodes.item(0)
    val referenceURI = "#request"

    // Ключ подписи.
    val keyStore = KeyStore.getInstance(JCP.HD_STORE_NAME, JCP.PROVIDER_NAME)
    keyStore.load(null, null)
    // Ключ подписи.
    val privateKey = keyStore.getKey(keyStoreAlias, keyStorePassword.toCharArray()) as PrivateKey
    // Сертификат для проверки.
    val cert = keyStore.getCertificate(keyStoreAlias) as X509Certificate

    // 3. Алгоритмы.
    val keyingProvider = DirectKeyingDataProvider(cert, privateKey)
    val sigProf = XadesTSigningProfile(keyingProvider)
        // time-stamp provider. Дополнительно задается список соответствий между
        // алгоритмом хеширования и адресом TSP службы
        .withTimeStampTokenProvider(GostTimeStampTokenProvider(GostXAdESUtility.MAP_DIGEST_OID_2_TSA_URL, JCP.PROVIDER_NAME))

        // digest provider
        .withDigestEngineProvider(object : DefaultMessageDigestProvider() { // digest

            @Throws(UnsupportedAlgorithmException::class)
            override fun getEngine(digestAlgorithmURI: String): MessageDigest {
                try {
                    return MessageDigest.getInstance(JCP.GOST_DIGEST_OID)
                } catch (e: NoSuchAlgorithmException) {
                    throw UnsupportedAlgorithmException(e.message, digestAlgorithmURI, e)
                }

            }

        })

        .withAlgorithmsProviderEx(object : DefaultAlgorithmsProviderEx() { // algorithms

            private var digestUrn: String? = null


            @Throws(UnsupportedAlgorithmException::class)
            override fun getSignatureAlgorithm(keyAlgorithmName: String): Algorithm {
                digestUrn = Consts.URI_GOST_DIGEST
                return GenericAlgorithm(Consts.URI_GOST_SIGN)
            }

            override fun getDigestAlgorithmForReferenceProperties(): String? {
                return digestUrn
            }

            override fun getDigestAlgorithmForDataObjsReferences(): String? {
                return digestUrn
            }

            override fun getDigestAlgorithmForTimeStampProperties(): String? {
                return digestUrn
            }

        })

    // 4. Подпись.
    val signer = sigProf.newSigner()
    val dataObj = DataObjectReference(referenceURI)
    dataObj.withTransform(EnvelopedSignatureTransform())
    dataObj.withTransform(ExclusiveCanonicalXMLWithoutComments())
    val dataObjects = SignedDataObjects(dataObj)
    signer.sign(dataObjects, nodeToSign)
}

xades4j.production.SigningCertKeyUsageException: KeyUsage on the signing certificate doesn't include 'digitalSignature' nor 'nonRepudiation'
at xades4j.production.KeyInfoBuilder.buildKeyInfo(KeyInfoBuilder.java:57) ~[xades4j-1.3.2.jar:na]
at xades4j.production.SignerBES.sign(SignerBES.java:175) ~[xades4j-1.3.2.jar:na]
at xades4j.production.SignerBES.sign(SignerBES.java:122) ~[xades4j-1.3.2.jar:na]
at ru.ksbsoft.gisgkh.adapter.ServiceAdapter.signXades(ServiceAdapter.kt:181) ~[classes/:na]