@Override
    public VerifiedJwt verifyMacAndDecode(String compact, JwtValidator validator)
        throws GeneralSecurityException {
      JwtFormat.Parts parts = JwtFormat.splitSignedCompact(compact);
      mac.verifyMac(parts.signatureOrMac, parts.unsignedCompact.getBytes(US_ASCII));
      JsonObject parsedHeader = JsonUtil.parseJson(parts.header);
      JwtFormat.validateHeader(
          parsedHeader,
          jwtHmacKey.getParameters().getAlgorithm().getStandardName(),
          jwtHmacKey.getKid(),
          jwtHmacKey.getParameters().allowKidAbsent());
      RawJwt token = RawJwt.fromJsonPayload(JwtFormat.getTypeHeader(parsedHeader), parts.payload);
      return validator.validate(token);
    }
This key manager generates new {@code JwtHmacKey} keys and produces new instances of {@link
JwtHmac}.
java_src/src/main/java/com/google/crypto/tink/jwt/JwtHmacKeyManager.java