static Optional<String> getKid(int keyId, OutputPrefixType prefix) throws JwtInvalidException {
    if (prefix == OutputPrefixType.RAW) {
      return Optional.empty();
    }
    if (prefix == OutputPrefixType.TINK) {
      byte[] bigEndianKeyId = ByteBuffer.allocate(4).putInt(keyId).array();
      return Optional.of(Base64.urlSafeEncode(bigEndianKeyId));
    }
    throw new JwtInvalidException("unsupported output prefix type");
  }
Validates the parsed header.

tinkKid should only be set for keys with output prefix type TINK. customKid should only
be set for keys with output prefix type RAW. They should not be set at the same time.
java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java