// In FIPS mode, require that one of SunJSSE's own keymanagers
	// is used. Otherwise, we cannot be sure that only keys from
	// the FIPS token are used.
	if ((km instanceof X509KeyManagerImpl) || (km instanceof SunX509KeyManagerImpl)) {
		return (X509ExtendedKeyManager)km;
	} else {
		// throw exception, we don't want to silently use the
		// dummy keymanager without telling the user.
		throw new KeyManagementException ("FIPS mode: only SunJSSE KeyManagers may be used");
	}