code: protected synchronized RSAPrivateKey getPrivateKey() {
          try {
              ConfidentialStore cs = ConfidentialStore.get();
              if (priv == null || cs != lastCS) {
                  lastCS = cs;
                  byte[] payload = load();
                  if (payload == null) {
                      KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
                      gen.initialize(2048, new SecureRandom()); // going beyond 2048 requires crypto extension
                      KeyPair keys = gen.generateKeyPair();
                      priv = (RSAPrivateKey) keys.getPrivate();
                      pub = (RSAPublicKey) keys.getPublic();
                      store(priv.getEncoded());
                  } else {
                      KeyFactory keyFactory = KeyFactory.getInstance("RSA");
                      priv = (RSAPrivateKey) keyFactory.generatePrivate(new PKCS8EncodedKeySpec(payload));
  
                      RSAPrivateCrtKey pks = (RSAPrivateCrtKey) priv;
                      pub = (RSAPublicKey) keyFactory.generatePublic(
                              new RSAPublicKeySpec(pks.getModulus(), pks.getPublicExponent()));
                  }
              }
              return priv;
          } catch (IOException | GeneralSecurityException e) {
              throw new Error("Failed to load the key: " + getId(), e);
          }
      }
docs: Obtains the private key (lazily.)
  <p>
  This method is not publicly exposed as per the design principle of {@link ConfidentialKey}.
  Instead of exposing private key, define methods that use them in specific way, such as
  {@link RSADigitalSignatureConfidentialKey}.
  
  @throws Error
  If key cannot be loaded for some reasons, we fail.