message: Use GoogleNetHttpTransport.newTrustedTransport() as the HTTP transport for GcpKmsClient.
  To avoid changing the method signature of the existing
  GcpKmsClient::WithCredentials(GoogleCredential) factory method, this
  will not apply to GcpKmsClient objects created with that method.
diff: package com.google.crypto.tink.integration.gcpkms;
  import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
  +import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
  import com.google.api.client.http.javanet.NetHttpTransport;
  import com.google.api.client.json.jackson2.JacksonFactory;
  import com.google.api.services.cloudkms.v1.CloudKMS;
  @@ -121,17 +122,21 @@ public final class GcpKmsClient implements KmsClient {
  }
  /** Loads the provided credentials with {@code GoogleCredentials}. */
  - public KmsClient withCredentials(GoogleCredentials credentials) {
  + public KmsClient withCredentials(GoogleCredentials credentials) throws GeneralSecurityException {
  if (credentials.createScopedRequired()) {
  credentials = credentials.createScoped(CloudKMSScopes.all());
  }
  + try {
  this.client =
  new CloudKMS.Builder(
  - new NetHttpTransport(),
  + GoogleNetHttpTransport.newTrustedTransport(),
  new JacksonFactory(),
  new HttpCredentialsAdapter(credentials))
  .setApplicationName(APPLICATION_NAME)
  .build();
  + } catch (IOException e) {
  + throw new GeneralSecurityException("cannot build GCP KMS client", e);
  + }
  return this;
  }
  