public Optional<KeyStore> getTrustStore() throws CaTruststoreException {
        try {
            return caPersistenceService.loadKeyStore()
                    .map(CaKeystoreWithPassword::keyStore)
                    .map(CaTruststoreImpl::filterOutPrivateKey);
        } catch (KeyStoreStorageException e) {
            throw new CaTruststoreException(e);
        }
    }
@Test
    void testAbsenceOfPrivateKey() throws Exception {
        final KeyPair caKeys = generateCaKeys();

        final String password = "my-pass";
        final KeyStore keystore = caKeys.toKeystore(CertConstants.CA_KEY_ALIAS, password.toCharArray());

        // verify that the keystore contains a private key. It should be there, together with a cert
        Assertions.assertThat(keystore.isKeyEntry(CertConstants.CA_KEY_ALIAS)).isTrue();

        final CaTruststore truststore = new CaTruststoreImpl(mockCaService(keystore, password));
        Assertions.assertThat(truststore.getTrustStore())
                .isPresent()
                .hasValueSatisfying(ts -> {
                    try {
                        // no private key, just a certificate
                        Assertions.assertThat(ts.isKeyEntry(CertConstants.CA_KEY_ALIAS)).isFalse();
                        Assertions.assertThat(ts.isCertificateEntry(CertConstants.CA_KEY_ALIAS)).isTrue();
                    } catch (KeyStoreException e) {
                        throw new RuntimeException(e);
                    }
                });
    }