PDFBOX-5940: add comment based on remarks by mkl

git-svn-id: https://svn.apache.org/repos/asf/pdfbox/trunk@1923409 13f79535-47bb-0310-9956-ffa450edef68

Author: THausherr

examples/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java

@@ -138,6 +138,9 @@ public byte[] sign(InputStream content) throws IOException
         {
             CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
             X509Certificate cert = (X509Certificate) certificateChain[0];
+            // cert.getSigAlgName() returns the algorithm the certificate itself has been signed with,
+            // this is usually also the algorithm to use for signing, but not always.
+            // See also the comment by mkl at the bottom of https://issues.apache.org/jira/browse/PDFBOX-5940
             ContentSigner sha1Signer = new JcaContentSignerBuilder(cert.getSigAlgName()).build(privateKey);
             gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().build()).build(sha1Signer, cert));
             gen.addCertificates(new JcaCertStore(Arrays.asList(certificateChain)));