public KeysetHandle getPublicKeysetHandle() throws GeneralSecurityException {
    if (keyset == null) {
      throw new GeneralSecurityException("cleartext keyset is not available");
    }

    Keyset.Builder publicKeysetBuilder = Keyset.newBuilder();
    List<KeysetHandle.Entry> publicEntries = new ArrayList<>(entries.size());

    int i = 0;
    for (KeysetHandle.Entry entry : entries) {
      KeysetHandle.Entry publicEntry;
      Keyset.Key publicProtoKey;

      if (entry != null && entry.getKey() instanceof PrivateKey) {
        Key publicKey = ((PrivateKey) entry.getKey()).getPublicKey();
        publicEntry =
            new KeysetHandle.Entry(publicKey, entry.getStatus(), entry.getId(), entry.isPrimary());
        publicProtoKey = createKeysetKey(publicKey, entry.getStatus(), entry.getId());
      } else {
        Keyset.Key protoKey = keyset.getKey(i);
        KeyData keyData = getPublicKeyDataFromRegistry(protoKey.getKeyData());
        publicProtoKey = protoKey.toBuilder().setKeyData(keyData).build();
        try {
          Key publicKey = toKey(publicProtoKey);
          int id = publicProtoKey.getKeyId();
          publicEntry =
              new KeysetHandle.Entry(
                  publicKey,
                  parseStatus(publicProtoKey.getStatus()),
                  id,
                  id == keyset.getPrimaryKeyId());
        } catch (GeneralSecurityException e) {
          publicEntry = null;
        }
      }

      publicKeysetBuilder.addKey(publicProtoKey);
      publicEntries.add(publicEntry);
      i++;
    }
    publicKeysetBuilder.setPrimaryKeyId(keyset.getPrimaryKeyId());
    return new KeysetHandle(publicKeysetBuilder.build(), publicEntries, annotations);
  }
If the managed keyset contains private keys, returns a {@link KeysetHandle} of the public keys.

@throws GeneralSecurityException if the managed keyset is null or if it contains any
    non-private keys.
java_src/src/main/java/com/google/crypto/tink/KeysetHandle.java