Signature.getParameters should state that it can throw UOE because it calls SignatureSpi.engineGetParameters which throws UOE by default unless overridden. This would let callers know that so that they could handle UOE if necessary.