private static void handleTokenResealing(ToolInvocation invocation, CommandLine arguments, String inputArg, Optional<String> maybeKeyId) throws IOException {
        var sealedSharedKey = SealedSharedKey.fromTokenString(inputArg);
        ToolUtils.verifyExpectedKeyId(sealedSharedKey, maybeKeyId);

        var recipientPubKey = KeyUtils.fromBase58EncodedX25519PublicKey(CliUtils.optionOrThrow(arguments, RECIPIENT_PUBLIC_KEY_OPTION).strip());
        var recipientKeyId  = KeyId.ofString(CliUtils.optionOrThrow(arguments, RECIPIENT_KEY_ID_OPTION));
        var privateKey      = ToolUtils.resolvePrivateKeyFromInvocation(invocation, sealedSharedKey.keyId(), true);
        var secretShared    = SharedKeyGenerator.fromSealedKey(sealedSharedKey, privateKey);
        var resealedShared  = SharedKeyGenerator.reseal(secretShared, recipientPubKey, recipientKeyId);

        invocation.stdOut().println(resealedShared.sealedSharedKey().toTokenString());
    }
Tooling for resealing a token for another recipient. This allows for delegating
decryption to another party without having to reveal the private key of the original
recipient.

@author vekterli
vespaclient-java/src/main/java/com/yahoo/vespa/security/tool/crypto/ResealTool.java