private static JwtRsaSsaPssPublicKey getPublicKeyFromProto(
      com.google.crypto.tink.proto.JwtRsaSsaPssPublicKey protoKey,
      OutputPrefixType outputPrefixType,
      @Nullable Integer idRequirement)
      throws GeneralSecurityException {
    validateVersion(protoKey.getVersion());

    JwtRsaSsaPssParameters.Builder parametersBuilder = JwtRsaSsaPssParameters.builder();
    JwtRsaSsaPssPublicKey.Builder keyBuilder = JwtRsaSsaPssPublicKey.builder();

    if (outputPrefixType.equals(OutputPrefixType.TINK)) {
      if (protoKey.hasCustomKid()) {
        throw new GeneralSecurityException(
            "Keys serialized with OutputPrefixType TINK should not have a custom kid");
      }
      if (idRequirement == null) {
        throw new GeneralSecurityException(
            "Keys serialized with OutputPrefixType TINK need an ID Requirement");
      }
      parametersBuilder.setKidStrategy(JwtRsaSsaPssParameters.KidStrategy.BASE64_ENCODED_KEY_ID);
      keyBuilder.setIdRequirement(idRequirement);
    } else if (outputPrefixType.equals(OutputPrefixType.RAW)) {
      if (protoKey.hasCustomKid()) {
        parametersBuilder.setKidStrategy(JwtRsaSsaPssParameters.KidStrategy.CUSTOM);
        keyBuilder.setCustomKid(protoKey.getCustomKid().getValue());
      } else {
        parametersBuilder.setKidStrategy(JwtRsaSsaPssParameters.KidStrategy.IGNORED);
      }
    }

    BigInteger modulus = decodeBigInteger(protoKey.getN());
    int modulusSizeInBits = modulus.bitLength();
    parametersBuilder
        .setAlgorithm(ALGORITHM_CONVERTER.fromProtoEnum(protoKey.getAlgorithm()))
        .setPublicExponent(decodeBigInteger(protoKey.getE()))
        .setModulusSizeBits(modulusSizeInBits);

    keyBuilder.setModulus(modulus).setParameters(parametersBuilder.build());

    return keyBuilder.build();
  }
Encodes a BigInteger using a big-endian encoding.
java_src/src/main/java/com/google/crypto/tink/jwt/JwtRsaSsaPssProtoSerialization.java