public static KeysetHandle getKeysetHandle(
      InputStream inputStream, String inFormat, String masterKeyUri, String credentialPath)
      throws IOException, GeneralSecurityException {
    byte[] keyset = toByteArray(inputStream);
    if (masterKeyUri != null) {
      Aead masterKey =
          KmsClientsFactory.globalInstance()
              .newClientFor(masterKeyUri)
              .withCredentials(credentialPath)
              .getAead(masterKeyUri);
      if (isJson(inFormat)) {
        return TinkJsonProtoKeysetFormat.parseEncryptedKeyset(
            new String(keyset, UTF_8), masterKey, new byte[] {});
      } else {
        return TinkProtoKeysetFormat.parseEncryptedKeyset(keyset, masterKey, new byte[] {});
      }
    }
    if (isJson(inFormat)) {
      return TinkJsonProtoKeysetFormat.parseKeyset(
          new String(keyset, UTF_8), InsecureSecretKeyAccess.get());
    }
    return TinkProtoKeysetFormat.parseKeyset(keyset, InsecureSecretKeyAccess.get());
  }
Returns a {@code KeysetHandle} from either a cleartext {@code Keyset} or a {@code
EncryptedKeyset}, read from {@code inputStream}.
tools/tinkey/src/main/java/com/google/crypto/tink/tinkey/TinkeyUtil.java