@Theory
  public void getPrimitiveFromNonSignatureKeyset_throws()
      throws Exception {
    KeysetHandle handle =
        TinkJsonProtoKeysetFormat.parseKeyset(
            JSON_DAEAD_KEYSET, InsecureSecretKeyAccess.get());

    // Test that the keyset can create a DeterministicAead primitive, but neither PublicKeySign
    // nor PublicKeyVerify primitives.
    Object unused = handle.getPrimitive(DeterministicAead.class);
    assertThrows(GeneralSecurityException.class, () -> handle.getPrimitive(PublicKeySign.class));
    assertThrows(GeneralSecurityException.class, () -> handle.getPrimitive(PublicKeyVerify.class));
  }
Unit tests for the Signature package. Uses only the public API.
java_src/src/test/java/com/google/crypto/tink/signature/SignatureTest.java