SonarCloud reports that we have a new path to NPE here:

PKCS8Key.java:

    /**
     * Returns the DER-encoded form of the key as a byte array,
     * or {@code null} if an encoding error occurs.
     */
    public byte[] getEncoded() {
        return getEncodedInternal().clone(); // <--- potential NPE
    }

Even though the method spec says we should just return null here. New path is exposed by JDK-8298420 that rewrote getEncodedInternal() to return null when IOException occurs:

    /**
     * DER-encodes this key as a byte array stored inside this object
     * and return it.
     *
     * @return the encoding
     */
    private synchronized byte[] getEncodedInternal() {
        if (encodedKey == null) {
            try {
                encodedKey = generateEncoding();
            } catch (IOException e) {
               return null;
            }
        }
        return encodedKey;
    }