@Override
    public int invoke(ToolInvocation invocation) {
        try {
            var arguments    = invocation.arguments();
            var leftoverArgs = arguments.getArgs();
            if (leftoverArgs.length != 1) {
                throw new IllegalArgumentException("Expected exactly 1 token argument to re-seal");
            }
            var inputArg   = leftoverArgs[0].strip();
            var maybeKeyId = Optional.ofNullable(arguments.hasOption(EXPECTED_KEY_ID_OPTION)
                                                 ? arguments.getOptionValue(EXPECTED_KEY_ID_OPTION)
                                                 : null);
            if (arguments.hasOption(RESEAL_REQUEST_OPTION)) {
                handleResealingRequest(invocation, inputArg, maybeKeyId);
            } else {
                handleTokenResealing(invocation, arguments, inputArg, maybeKeyId);
            }
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
        return 0;
    }
Tooling for resealing a token for another recipient. This allows for delegating
decryption to another party without having to reveal the private key of the original
recipient.

@author vekterli
vespaclient-java/src/main/java/com/yahoo/vespa/security/tool/crypto/ResealTool.java