@Override
  public Aead getAead(String uri) throws GeneralSecurityException {
    if (this.keyUri != null && !this.keyUri.equals(uri)) {
      throw new GeneralSecurityException(
          String.format(
              "this client is bound to %s, cannot load keys bound to %s", this.keyUri, uri));
    }
    try {
      synchronized (keystoreLock) {
        Aead aead =
            new AndroidKeystoreAesGcm(Validators.validateKmsKeyUriAndRemovePrefix(PREFIX, uri));
        return validateAead(aead);
      }
    } catch (IOException ex) {
      throw new GeneralSecurityException(ex);
    }
  }
Returns an {@link Aead} backed by a key in Android Keystore specified by {@code uri}.

<p>Since Android Keystore is somewhat unreliable, a self-test is done against the key. This
will incur a small performance penalty.
java_src/src/main/java/com/google/crypto/tink/integration/android/AndroidKeystoreKmsClient.java