public static KeyTemplate createKmsEnvelopeAeadKeyTemplate(
      String kekUri, KeyTemplate dekTemplate) {
    KmsEnvelopeAeadKeyFormat format = KmsEnvelopeAeadKeyFormat.newBuilder()
        .setDekTemplate(dekTemplate)
        .setKekUri(kekUri)
        .build();
    return KeyTemplate.newBuilder()
        .setValue(format.toByteString())
        .setTypeUrl(KmsEnvelopeAeadKeyManager.getKeyType())
        .setOutputPrefixType(OutputPrefixType.RAW)
        .build();
  }
Returns a new {@link KeyTemplate} that can generate a {@link
com.google.crypto.tink.proto.KmsEnvelopeAeadKey} whose key encrypting key (KEK) is pointing to
{@code kekUri} and DEK template is {@code dekTemplate}. Keys generated by this key template
uses RAW output prefix to make them compatible with the remote KMS' encrypt/decrypt operations.
Unlike other templates, when you generate new keys with this template, Tink does not generate
new key material, but only creates a reference to the remote KEK.
java_src/src/main/java/com/google/crypto/tink/aead/AeadKeyTemplates.java