private function getSigningCredentials(ConnectionInterface $connection, array $options)
    {
        $keyFilePath = isset($options['keyFilePath'])
            ? $options['keyFilePath']
            : null;

        if ($keyFilePath) {
            if (!file_exists($keyFilePath)) {
                throw new \InvalidArgumentException(sprintf(
                    'Keyfile path %s does not exist.',
                    $keyFilePath
                ));
            }

            $options['keyFile'] = self::jsonDecode(file_get_contents($keyFilePath), true);
        }

        $rw = $connection->requestWrapper();

        $keyFile = isset($options['keyFile'])
            ? $options['keyFile']
            : null;
        if ($keyFile) {
            $scopes = isset($options['scopes'])
                ? $options['scopes']
                : $rw->scopes();

            $credentials = CredentialsLoader::makeCredentials($scopes, $keyFile);
        } else {
            $credentials = $rw->getCredentialsFetcher();
        }

        if (!($credentials instanceof SignBlobInterface)) {
            throw new \RuntimeException(sprintf(
                'Credentials object is of type `%s` and is not valid for signing.',
                get_class($credentials)
            ));
        }

        unset(
            $options['keyFilePath'],
            $options['keyFile'],
            $options['scopes']
        );

        return [$credentials, $options];
    }