// Check if a key already exists.
// If no key exists, generate a public key pair
var keyHandle: KeyHandle =  TrifleApi.generateKeyHandle("abc")
                
// Storing keys. Key handles are serializable.
val encoded: ByteArray = keyHandle.serialize()

// Load the key from storage when we need to use it
val decoded: KeyHandle = KeyHandle.deserialize(encoded)

// Check the validity of loaded key
val valid: Boolean = trifleApi.isValid(keyHandle)

// Destroy key that is no longer in use or is invalid
trifleApi.delete(keyHandle)
        
// Check if loaded key already has a cert. If yes, skip to checking for cert validity
// Else if key does not have a cert OR if a new cert must be generated (eg because of existing
// cert is already expired, or app needs to re-attest, app is re-installed, app is restored
// from backup, ... etc)

// Create cert request with an entity identity that is associated with the public key
val certReq: CertificateRequest = TrifleApi.generateMobileCertificateRequest(entity, keyHandle)

// Serialize as an opaque ByteArray
val encoded: ByteArray = certReq.serialize()

// Send certificate request to Certificate Authority endpoint. Response will be List<ByteArray>
val response: List<ByteArray>

// Iterate over each ByteArray to convert to Certificate
val certs: List<Certificate> = response.map { Certificate.deserialize(it) }

// certs is a list of certificates where [0] will be device certificate
// and the rest of the elements will be intermediate chain.

// Check if app has the root cert of Certificate Authority (CA). 

// Validate cert matches the certificate request (so generated key) 
// and the root (so it has been generated by the right CA).
val result: Result<Unit> = TrifleApi.verify(certs[0], certReq, certs, root)

// Once it passes validation, certReq is no longer needed, and it can be deleted
// Store cert along with the respective keyHandle
        
// To check only for the validity of a stored cert, you can do either of below choices
// Option 1 is a more complete check of the device cert and the full chain
val result: Result<Unit> = TrifleApi.verify(cert, ancestorCertificateChain = certs.drop(1))

// option 2 only checks the validity of the device cert
val result: Result<Unit> = TrifleApi.verify(cert)

// Error handling from the Result.isFailure can be found in the enumeration in TrifleErrors
if (result.isFailure) {
  when (result.getExceptionOrNull) {
    is NoTrustAnchor -> {} // trust anchor is missing
    is InvalidCertPath -> {} // certificate path is invalid
    is ExpiredCertificate -> {} // certificate has expired
    is InvalidSignature -> {} // signature did not match
    is CSRMismatch -> {} // attributes in the cert did not match CSR
    else -> {} // unspecified failure
  }
}

// Sign the data
val signedData: SignedData = TrifleApi.createSignedData(clientData, keyHandle, certs)

// Serialize as an opaque ByteArray
val encodedSignedData: ByteArray = signedData.serialize()