private static SecretSharedKey secretFromInteractiveResealing(ToolInvocation invocation, String inputArg,
                                                                  String outputArg, SealedSharedKey sealedSharedKey) throws IOException {
        if (CliUtils.useStdIo(outputArg) || CliUtils.useStdIo(inputArg)) {
            throw new IllegalArgumentException("Interactive token resealing not available with redirected I/O");
        }
        var session = SharedKeyResealingSession.newEphemeralSession();
        var req     = session.resealingRequestFor(sealedSharedKey);

        invocation.stdOut().format("\nInteractive token resealing request:\n\n%s\n\n", req.toSerializedString());
        invocation.stdOut().format("Paste response and hit return: ");

        try (var reader = new BufferedReader(new InputStreamReader(invocation.stdIn()))) {
            var serializedRes = reader.readLine().strip();
            if (serializedRes.isEmpty()) {
                throw new IllegalArgumentException("Empty response; aborting");
            }
            var res = SharedKeyResealingSession.ResealingResponse.fromSerializedString(serializedRes);
            return session.openResealingResponse(res);
        }
    }
Tooling for decrypting a file using a private key that corresponds to the public key used
to originally encrypt the file.

Uses the opaque token abstraction from {@link SharedKeyGenerator}.

@author vekterli
vespaclient-java/src/main/java/com/yahoo/vespa/security/tool/crypto/DecryptTool.java