private VersionedKeyPair sealingKeyPair(SecretVersionId version) {
        if (sealingPrivateKeySecretName.isEmpty()) {
            throw new IllegalArgumentException("Cannot retrieve sealing key because its secret name is unset");
        }
        Key key = Key.fromString(sealingPrivateKeySecretName.get());
        Secret sealingPrivateKey = version == null ? secretStore.getSecret(key) : secretStore.getSecret(key, version);
        PrivateKey privateKey = KeyUtils.fromPemEncodedPrivateKey(sealingPrivateKey.secretValue().value());
        PublicKey publicKey = KeyUtils.extractPublicKey(privateKey);
        if (KeyAlgorithm.from(privateKey.getAlgorithm()) != KeyAlgorithm.XDH) {
            throw new IllegalArgumentException("Expected sealing key to use algorithm " + KeyAlgorithm.XDH +
                                               ", but got " + privateKey.getAlgorithm());
        }
        return new VersionedKeyPair(new KeyPair(publicKey, privateKey), sealingPrivateKey.version());
    }
Returns the key pair to use when sealing the snapshot encryption key
node-repository/src/main/java/com/yahoo/vespa/hosted/provision/backup/Snapshots.java