$ java --enable-preview -cp ... Migration     (27.0.1.0.2+1)
== 1. load an RSA private key (PKCS#8)
ok: BouncyCastle and the JDK produce equal keys
BC parser returned: PrivateKeyInfo
== 2. load a certificate
ok: same certificate either way
== 3. write keys
ok: JcaPEMWriter and PEMEncoder write identical public-key text (line terminators aside)
JcaPEMWriter on an RSA private key writes: -----BEGIN RSA PRIVATE KEY-----
PEMEncoder on an RSA private key writes:   -----BEGIN PRIVATE KEY-----
== 4. encrypted PKCS#8 key (BC needs its own provider for AES/CBC/PKCS7Padding; the JDK does not)
ok: same key either way
== 5. what BouncyCastle reads and the JDK does not
EC PRIVATE KEY (SEC1): BC -> PEMKeyPair, JDK -> PEM(type=EC PRIVATE KEY) - NOT decoded
ok: after 'openssl pkcs8 -topk8 -nocrypt' the JDK reads the same secret scalar BC read from SEC1
Proc-Type: 4,ENCRYPTED: BC -> PEMEncryptedKeyPair decrypted to RSA
ok: ...and it is the same RSA key
Proc-Type: 4,ENCRYPTED: JDK !! java.lang.IllegalArgumentException: java.security.InvalidKeyException: Invalid PKCS#1 encoding
== 6. Spring Security RsaKeyConverters (RSA only; PKCS#8 and X.509 only)
ok: pkcs8() reads the RSA private key
ok: x509() reads the RSA public key
pkcs8() on an EC key !! java.lang.IllegalArgumentException: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: Invalid RSA private key
pkcs8() on the PKCS#1 key !! java.lang.IllegalArgumentException: Key is not in PEM-encoded PKCS#8 format, please check that the header begins with -----BEGIN PRIVATE KEY-----
JDK on the EC key -> PrivateKey EC
exit=0