private static byte[] validatePubKeyAndClearMsb(byte[] pubKey) throws InvalidKeyException {
    if (pubKey.length != 32) {
      throw new InvalidKeyException("Public key length is not 32-byte");
    }
    // Clears the most significant bit as in the method decodeUCoordinate() of RFC7748.
    byte[] pubKeyWithoutMsb = Arrays.copyOf(pubKey, pubKey.length);
    pubKeyWithoutMsb[31] &= (byte) 0x7f;

    for (int i = 0; i < BANNED_PUBLIC_KEYS.length; i++) {
      if (Bytes.equal(BANNED_PUBLIC_KEYS[i], pubKeyWithoutMsb)) {
        throw new InvalidKeyException("Banned public key: " + Hex.encode(BANNED_PUBLIC_KEYS[i]));
      }
    }
    return pubKeyWithoutMsb;
  }
Validates public key and clear its most significant bit.

@throws InvalidKeyException iff the {@code pubKey} is in the banned list or its length is not
    32-byte.
java_src/src/main/java/com/google/crypto/tink/internal/Curve25519.java