fix: handle empty key store correctly for IdentityServerSigningCreden…

src/Open.IdentityServer/src/Stores/Compatibility/IdentityServerSigningCredentialStore.cs

@@ -28,6 +28,6 @@ public async Task<SigningCredentials> GetSigningCredentialsAsync()
             .Select(dataProtectedIdentityServerKeyMaterialConverter.Convert)
             .OrderByDescending(x => x.Created)
             .Select(x => x.Credentials)
-            .First();
+            .FirstOrDefault();
     }
 }

src/Open.IdentityServer/test/Open.IdentityServer.UnitTests/Stores/Compatibility/IdentityServerSigningCredentialStoreTests.cs

@@ -325,4 +325,17 @@ public async Task GetSigningCredentialsAsync_WhenProtected_AndSingleECDsaKeyWrap
 
         actual.Should().BeEquivalentTo(expectedSigningCredentials);
     }
+
+    [Fact]
+    public async Task GetSigningCredentialsAsync_WhenTableIsEmpty_ShouldReturnNull()
+    {
+        Mock.Get(_identityServerKeyStore)
+            .Setup(x => x.GetKeys())
+            .Returns([]);
+
+        var sut = CreateSut();
+        var actual = await sut.GetSigningCredentialsAsync();
+
+        actual.Should().BeNull();
+    }
 }

src/Open.IdentityServer/test/Open.IdentityServer.UnitTests/Stores/Compatibility/IdentityServerValidationKeysStoreTests.cs

@@ -177,4 +177,17 @@ public async Task GetValidationKeysAsync_ShouldReturnCollectionSecurityKeyInfo_A
 
         actual.Should().BeEquivalentTo(expectedCredentials);
     }
+
+    [Fact]
+    public async Task GetValidationKeysAsync_WhenTableIsEmpty_ShouldReturnEmptyList()
+    {
+        Mock.Get(_identityServerKeyStore)
+            .Setup(x => x.GetKeys())
+            .Returns([]);
+
+        var sut = CreateSut();
+        var actual = await sut.GetValidationKeysAsync();
+
+        actual.Should().BeEmpty();
+    }
 }