code: static SecretKeySpec readSecretKey(DecryptionSetup ds) {
      Keyed<?> ksObject = DKV.getGet(ds._keystore_id);
      ByteVec ksVec = (ByteVec) (ksObject instanceof Frame ? ((Frame) ksObject).vec(0) : ksObject);
      InputStream ksStream = ksVec.openStream(null /*job key*/);
      try {
        KeyStore keystore = KeyStore.getInstance(ds._keystore_type);
        keystore.load(ksStream, ds._password);
  
        if (! keystore.containsAlias(ds._key_alias)) {
          throw new IllegalArgumentException("Alias for key not found");
        }
  
        java.security.Key key = keystore.getKey(ds._key_alias, ds._password);
        return new SecretKeySpec(key.getEncoded(), key.getAlgorithm());
      } catch (GeneralSecurityException e) {
        throw new RuntimeException("Unable to load key " + ds._key_alias + " from keystore " + ds._keystore_id, e);
      } catch (IOException e) {
        throw new RuntimeException("Failed to read keystore " + ds._keystore_id, e);
      }
    }
docs: Retrieves a Secret Key using a given Decryption Setup.
  @param ds decryption setup
  @return SecretKey