@Theory
  public void testDecryptCustom_encryptBuiltIn_works(
      @FromDataPoints("allOutputPrefixTypes") OutputPrefixType outputPrefixType) throws Exception {
    HpkePublicKey protoPublicKey =
        HpkePublicKey.newBuilder()
            .setVersion(0)
            .setParams(getHpkeParams())
            .setPublicKey(ByteString.copyFrom(publicKeyByteArray))
            .build();
    HpkePrivateKey protoPrivateKey =
        HpkePrivateKey.newBuilder()
            .setVersion(0)
            .setPublicKey(protoPublicKey)
            .setPrivateKey(ByteString.copyFrom(privateKeyByteArray))
            .build();
    KeyData keyData =
        KeyData.newBuilder()
            .setTypeUrl(PRIVATE_TYPE_URL)
            .setValue(protoPrivateKey.toByteString())
            .setKeyMaterialType(KeyMaterialType.ASYMMETRIC_PRIVATE)
            .build();
    Keyset keyset =
        Keyset.newBuilder()
            .addKey(
                Keyset.Key.newBuilder()
                    .setKeyData(keyData)
                    .setStatus(KeyStatusType.ENABLED)
                    .setOutputPrefixType(outputPrefixType)
                    .setKeyId(0x23456789)
                    .build())
            .setPrimaryKeyId(0x23456789)
            .build();

    KeysetHandle handle =
        TinkProtoKeysetFormat.parseKeyset(keyset.toByteArray(), InsecureSecretKeyAccess.get());
    HybridDecrypt customDecrypter = handle.getPrimitive(HybridDecrypt.class);

    byte[] message = new byte[] {1, 2, 3};
    byte[] context = new byte[] {4};

    @Nullable Integer idRequirement = outputPrefixType == OutputPrefixType.RAW ? null : 0x23456789;
    HybridEncrypt tinkEncrypter =
        HpkeEncrypt.create(
            com.google.crypto.tink.hybrid.HpkePublicKey.create(
                getParameters(variantForOutputPrefix(outputPrefixType)),
                Bytes.copyFrom(publicKeyByteArray),
                idRequirement));
    byte[] ciphertext = tinkEncrypter.encrypt(message, context);
    assertThat(customDecrypter.decrypt(ciphertext, context)).isEqualTo(message);
  }
This encrypts using the subtle Tink API, then decrypts using the custom key manager with a
keyset with a single key.
java_src/src/test/java/com/google/crypto/tink/hybrid/KeyManagerIntegrationTest.java