How to know which key was used for SOAP body signature verification

Question

Using CXF I came across a problem: I would like to log the public key used to verify the signature provided on the SOAP request. Initially, I thought about extending the org.apache.ws.security.crypto.provider, but that allows me to check which keys are effectively loaded, but not which one was successfully used on each request.