private static KeyData newKeyData(com.google.crypto.tink.KeyTemplate keyTemplate)
      throws GeneralSecurityException {
    try {
      byte[] serializedKeyTemplate =
          TinkProtoParametersFormat.serialize(keyTemplate.toParameters());
      com.google.crypto.tink.proto.KeyTemplate protoTemplate =
          com.google.crypto.tink.proto.KeyTemplate.parseFrom(
              serializedKeyTemplate, ExtensionRegistryLite.getEmptyRegistry());
      KeyManager<?> manager =
          KeyManagerRegistry.globalInstance().getUntypedKeyManager(protoTemplate.getTypeUrl());
      if (KeyManagerRegistry.globalInstance().isNewKeyAllowed(protoTemplate.getTypeUrl())) {
        return manager.newKeyData(protoTemplate.getValue());
      } else {
        throw new GeneralSecurityException(
            "newKey-operation not permitted for key type " + protoTemplate.getTypeUrl());
      }
    } catch (InvalidProtocolBufferException e) {
      throw new GeneralSecurityException("Failed to parse serialized parameters", e);
    }
  }
Wraps a {@link TinkKey} and enforces access to the underlying {@link TinkKey} with {@link
KeyAccess}. Specifically, if the underlying {@link TinkKey} has a secret, then one can only get
it with a {@link SecretKeyAccess} instance.

<p>Do not use this in new code. Instead, use {@link com.google.crypto.tink.Key} and
these facilities.
java_src/src/main/java/com/google/crypto/tink/tinkkey/KeyHandle.java