public synchronized void restrictToFipsIfEmptyAndGlobalInstance()
      throws GeneralSecurityException {
    if (this != globalInstance()) {
      throw new GeneralSecurityException("Only the global instance can be restricted to FIPS.");
    }
    // If we are already using FIPS mode, do nothing.
    if (TinkFipsUtil.useOnlyFips()) {
      return;
    }

    if (!isEmpty()) {
      throw new GeneralSecurityException("Could not enable FIPS mode as Registry is not empty.");
    }
    TinkFipsUtil.setFipsRestricted();
  }
Restricts Tink to FIPS if this is the global instance.

<p>We make this a member method (instead of a static one which gets the global instance)
because the call to "useOnlyFips" needs to happen under the same mutex lock which protects the
registerKeyManager methods.
java_src/src/main/java/com/google/crypto/tink/internal/KeyManagerRegistry.java