static Optional<Integer> getKeyId(String kid) {
    byte[] encodedKeyId = Base64.urlSafeDecode(kid);
    if (encodedKeyId.length != 4) {
      return Optional.empty();
    }
    return Optional.of(ByteBuffer.wrap(encodedKeyId).getInt());
  }
Validates the parsed header.

tinkKid should only be set for keys with output prefix type TINK. customKid should only
be set for keys with output prefix type RAW. They should not be set at the same time.
java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java