@Theory
  public void serializeDeserializeKeysetsWithRejectedParams_works(
      @FromDataPoints("KeyManager rejected") HkdfPrfParameters params) throws Exception {
    com.google.crypto.tink.prf.HkdfPrfKey key =
        com.google.crypto.tink.prf.HkdfPrfKey.builder()
            .setParameters(params)
            .setKeyBytes(SecretBytes.randomBytes(params.getKeySizeBytes()))
            .build();
    KeysetHandle handle =
        KeysetHandle.newBuilder()
            .addEntry(KeysetHandle.importKey(key).withFixedId(1).makePrimary())
            .build();
    byte[] serializedKeyset =
        TinkProtoKeysetFormat.serializeKeyset(handle, InsecureSecretKeyAccess.get());
    KeysetHandle parsed =
        TinkProtoKeysetFormat.parseKeyset(serializedKeyset, InsecureSecretKeyAccess.get());
    assertTrue(parsed.equalsKeyset(handle));
  }
We allow serialization and deserialization with parameters which are otherwise rejected
java_src/src/test/java/com/google/crypto/tink/prf/HkdfPrfKeyManagerTest.java