static String getStringHeader(JsonObject header, String name) throws JwtInvalidException {
    if (!header.has(name)) {
      throw new JwtInvalidException("header " + name + " does not exist");
    }
    if (!header.get(name).isJsonPrimitive() || !header.get(name).getAsJsonPrimitive().isString()) {
      throw new JwtInvalidException("header " + name + " is not a string");
    }
    return header.get(name).getAsString();
  }
Validates the parsed header.

tinkKid should only be set for keys with output prefix type TINK. customKid should only
be set for keys with output prefix type RAW. They should not be set at the same time.
java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java