@Theory
  public void testEncryptCustom_decryptBuiltIn_works(
      @FromDataPoints("allOutputPrefixTypes") OutputPrefixType outputPrefixType) throws Exception {
    HpkePublicKey protoPublicKey =
        HpkePublicKey.newBuilder()
            .setVersion(0)
            .setParams(getHpkeParams())
            .setPublicKey(ByteString.copyFrom(publicKeyByteArray))
            .build();
    KeyData keyData =
        KeyData.newBuilder()
            .setTypeUrl(PUBLIC_TYPE_URL)
            .setValue(protoPublicKey.toByteString())
            .setKeyMaterialType(KeyMaterialType.ASYMMETRIC_PUBLIC)
            .build();
    Keyset keyset =
        Keyset.newBuilder()
            .addKey(
                Keyset.Key.newBuilder()
                    .setKeyData(keyData)
                    .setStatus(KeyStatusType.ENABLED)
                    .setOutputPrefixType(outputPrefixType)
                    .setKeyId(0x23456789)
                    .build())
            .setPrimaryKeyId(0x23456789)
            .build();

    KeysetHandle handle = TinkProtoKeysetFormat.parseKeysetWithoutSecret(keyset.toByteArray());
    HybridEncrypt customEncrypter = handle.getPrimitive(HybridEncrypt.class);

    byte[] message = new byte[] {1, 2, 3};
    byte[] context = new byte[] {4};
    byte[] ciphertext = customEncrypter.encrypt(message, context);

    @Nullable Integer idRequirement = outputPrefixType == OutputPrefixType.RAW ? null : 0x23456789;
    HybridDecrypt tinkDecrypter =
        HpkeDecrypt.create(
            com.google.crypto.tink.hybrid.HpkePrivateKey.create(
                com.google.crypto.tink.hybrid.HpkePublicKey.create(
                    getParameters(variantForOutputPrefix(outputPrefixType)),
                    Bytes.copyFrom(publicKeyByteArray),
                    idRequirement),
                SecretBytes.copyFrom(privateKeyByteArray, InsecureSecretKeyAccess.get())));
    assertThat(tinkDecrypter.decrypt(ciphertext, context)).isEqualTo(message);
  }
This test encrypts using a keyset with one key, with the custom key manager. It then decrypts
the ciphertext using normal Tink subtle HpkeDecrypt.
java_src/src/test/java/com/google/crypto/tink/hybrid/KeyManagerIntegrationTest.java