public static String fromPublicKeysetHandle(KeysetHandle handle)
      throws IOException, GeneralSecurityException {
    // Check validity of the keyset handle before calling "getAt".
    // See comments in {@link KeysetHandle#Entry#getAt}.
    handle = KeysetHandle.newBuilder(handle).build();
    // We never throw a IOException anymore, but keep it in the interface for compatibility.
    JsonArray keys = new JsonArray();
    for (int i = 0; i < handle.size(); i++) {
      KeysetHandle.Entry entry = handle.getAt(i);
      if (entry.getStatus() != KeyStatus.ENABLED) {
        continue;
      }
      Key key = entry.getKey();
      if (key instanceof JwtEcdsaPublicKey) {
        keys.add(convertJwtEcdsaKey((JwtEcdsaPublicKey) key));
      } else if (key instanceof JwtRsaSsaPkcs1PublicKey) {
        keys.add(convertJwtRsaSsaPkcs1Key((JwtRsaSsaPkcs1PublicKey) key));
      } else if (key instanceof JwtRsaSsaPssPublicKey) {
        keys.add(convertJwtRsaSsaPssKey((JwtRsaSsaPssPublicKey) key));
      } else {
        throw new GeneralSecurityException(
            "unsupported key with parameters " + key.getParameters());
      }
    }
    JsonObject jwkSet = new JsonObject();
    jwkSet.add("keys", keys);
    return jwkSet.toString();
  }
Converts a Tink KeysetHandle with JWT public keys into a Json Web Key (JWK) set.

<p>The currently supported algorithms are ES256, ES384, ES512, RS256, RS384, RS512, PS256,
PS384 and PS512. JWK is defined in https://www.rfc-editor.org/rfc/rfc7517.txt.
java_src/src/main/java/com/google/crypto/tink/jwt/JwkSetConverter.java