@Override
            public EncryptResponse execute() throws IOException {
              if (!aeads.containsKey(name)) {
                throw new IOException(
                    "Unknown key ID : " + name + " is not in " + aeads.keySet());
              }
              try {
                Aead aead = aeads.get(name);
                byte[] ciphertext =
                    aead.encrypt(
                        request.decodePlaintext(), request.decodeAdditionalAuthenticatedData());
                return new EncryptResponse().encodeCiphertext(ciphertext);
              } catch (GeneralSecurityException e) {
                throw new IOException(e.getMessage());
              }
            }
A partial, fake implementation of {@link com.google.api.services.cloudkms.v1.CloudKMS}.

<p>It creates a new AEAD for every valid key ID. CryptoKeys use them to encrypt and decrypt.
java_src/src/main/java/com/google/crypto/tink/integration/gcpkms/FakeCloudKms.java