private static Aead create(LegacyKmsAeadKey key) throws GeneralSecurityException {

    Aead rawAead =
        KmsClients.get(key.getParameters().keyUri()).getAead(key.getParameters().keyUri());
    return LegacyFullAead.create(rawAead, key.getOutputPrefix());
  }
This key manager produces new instances of {@code Aead} that forwards encrypt/decrypt requests to
a key residing in a remote KMS.
java_src/src/main/java/com/google/crypto/tink/aead/KmsAeadKeyManager.java