private static void validateKeyPair(
      HpkeParameters.KemId kemId, byte[] publicKeyBytes, byte[] privateKeyBytes)
      throws GeneralSecurityException {
    if (isNistKem(kemId)) {
      ECParameterSpec spec = getNistCurveParams(kemId);
      BigInteger order = spec.getOrder();
      BigInteger privateKey = BigIntegerEncoding.fromUnsignedBigEndianBytes(privateKeyBytes);
      if ((privateKey.signum() <= 0) || (privateKey.compareTo(order) >= 0)) {
        throw new GeneralSecurityException("Invalid private key.");
      }
      ECPoint expectedPoint = EllipticCurvesUtil.multiplyByGenerator(privateKey, spec);
      ECPoint publicPoint =
          EllipticCurves.pointDecode(
              spec.getCurve(), EllipticCurves.PointFormatType.UNCOMPRESSED, publicKeyBytes);
      if (!expectedPoint.equals(publicPoint)) {
        throw new GeneralSecurityException("Invalid private key for public key.");
      }
      return;
    }
    if (kemId == HpkeParameters.KemId.DHKEM_X25519_HKDF_SHA256) {
      byte[] expectedPublicKeyBytes = X25519.publicFromPrivate(privateKeyBytes);
      if (!Arrays.equals(expectedPublicKeyBytes, publicKeyBytes)) {
        throw new GeneralSecurityException("Invalid private key for public key.");
      }
      return;
    }
    throw new IllegalArgumentException("Unable to validate key pair for " + kemId);
  }
Confirms that the private key encoded as {@code privateKeyBytes} corresponds to the public key
encoded as {@code publicKeyBytes} given the HPKE {@code kemId}.
java_src/src/main/java/com/google/crypto/tink/hybrid/HpkePrivateKey.java