If you want to use the Apache Santuario JSR-105 Provider (instead of Oracle's), you could use
String providerName = "org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI";
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM", (Provider) Class.forName(providerName).newInstance());
Caveat emptor http://santuario.apache.org/java150releasenotes.html#java_1_5_0_release_notes-JSR105providerhasbeenrenamed