public static void rotate(OutputStream outputStream, String outFormat,
      InputStream inputStream, String inFormat,
      String masterKeyUri, String credentialPath,
      KeyTemplate keyTemplate) throws Exception {
    TinkeyUtil.createKey(
        TinkeyUtil.CommandType.ROTATE_KEYSET,
        outputStream,
        outFormat,
        inputStream,
        inFormat,
        masterKeyUri,
        credentialPath,
        keyTemplate.toParameters());
  }
Generates and adds a key of template {@code keyTemplate} to the keyset in
{@code inputStream} (using {@code credentialPath} to decrypt if it is encrypted).
Sets the new key as the primary key and writes the resulting keyset to
{@code outputStream}.
tools/tinkey/src/main/java/com/google/crypto/tink/tinkey/RotateKeysetCommand.java