private static void handleResealingRequest(ToolInvocation invocation, String inputArg, Optional<String> maybeKeyId) throws IOException {
        var request = SharedKeyResealingSession.ResealingRequest.fromSerializedString(inputArg);
        ToolUtils.verifyExpectedKeyId(request.sealedKey(), maybeKeyId);

        var privateKey = ToolUtils.resolvePrivateKeyFromInvocation(invocation, request.sealedKey().keyId(), true);
        var resealed   = SharedKeyResealingSession.reseal(request, (keyId) -> Optional.of(privateKey));

        invocation.stdOut().println(resealed.toSerializedString());
    }
Tooling for resealing a token for another recipient. This allows for delegating
decryption to another party without having to reveal the private key of the original
recipient.

@author vekterli
vespaclient-java/src/main/java/com/yahoo/vespa/security/tool/crypto/ResealTool.java