See also here: https://github.com/SAP/cloud-security-xsuaa-integration/tree/main/token-client#adapt-to-externally-managed-certificate