have a look at the API docs: https://docs.oracle.com/javacard/3.0.5/api/javacard/security/package-summary.html
MesageDigest, for example, only has a protected construstor. In that case getInstance(...) is your only chance.
These classes are not singleton for several reasons:
- these are stateful classes that contain the current state of an on-going operation. In particular, the update() method may accumulate data in an internal buffer before processing it.
- several application on the platform may need to perform the same operation at the same time so each need to use its own independent instance.
However, an application can get an instance and store it in a persistent field (e.g. in the Applet.install() method) then re-use it several times (e.g. in Applet.process() method)