This fully addresses the problem we had with SpongyCastle not being signed. We now have an interface ECCryptoProvider and this is implemented twice, once by a BouncyCastle and another by SpongyCastle. We just include the provider we want to use i.e. BouncyCastle on desktop/servers and SpongCastle on Android devices.