@Theory
  public void getPrimitiveNoPrimary_throwsNullPointerException() throws Exception {
    EcdsaParameters parameters =
        EcdsaParameters.builder()
            .setSignatureEncoding(EcdsaParameters.SignatureEncoding.IEEE_P1363)
            .setCurveType(EcdsaParameters.CurveType.NIST_P256)
            .setHashType(EcdsaParameters.HashType.SHA256)
            .setVariant(EcdsaParameters.Variant.LEGACY)
            .build();

    KeysetHandle handle = KeysetHandle.generateNew(parameters);
    Keyset keyset =
        Keyset.parseFrom(
            TinkProtoKeysetFormat.serializeKeyset(handle, InsecureSecretKeyAccess.get()),
            ExtensionRegistryLite.getEmptyRegistry());
    Keyset keysetWithoutPrimary = keyset.toBuilder().clearPrimaryKeyId().build();
    assertThrows(
        GeneralSecurityException.class,
        () ->
            TinkProtoKeysetFormat.parseKeyset(
                    keysetWithoutPrimary.toByteArray(), InsecureSecretKeyAccess.get())
                .getPrimitive(PublicKeySign.class));
  }
We test all variants for legacy reasons.
java_src/src/test/java/com/google/crypto/tink/signature/PublicKeySignWrapperTest.java