diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dffbcebee..8a3cd3be0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        rust: [1.65.0, 1.66.0]
+        rust: [1.71.1, 1.72.0]
     steps:
       - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
         with:
@@ -99,7 +99,7 @@ jobs:
       - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       - uses: actions/setup-go@f6164bd8c8acb4a71fb2791a8b6c4024ff038dab # v3
       - run: go install github.com/campoy/embedmd@v1.0.0
-      - uses: ruby/setup-ruby@52b8784594ec115fd17094752708121dc5dabb47 # v1.154.0
+      - uses: ruby/setup-ruby@c04af2bb7258bb6a03df1d3c1865998ac9390972 # v1.194.0
         with:
             ruby-version: '2.7'
             bundler-cache: true
diff --git a/Cargo.lock b/Cargo.lock
index 9167acc74..5381c01fe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,21 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "addr2line"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
 [[package]]
 name = "aead"
 version = "0.5.2"
@@ -107,6 +122,28 @@ version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "224afbd727c3d6e4b90103ece64b8d1b67fbb1973b1046c2281eed3f3803f800"
 
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.46",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.68"
@@ -118,6 +155,12 @@ dependencies = [
  "syn 2.0.46",
 ]
 
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "atty"
 version = "0.2.14"
@@ -137,18 +180,17 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "axum"
-version = "0.6.18"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8175979259124331c1d7bf6586ee7e0da434155e4b2d48ec2c8386281d8df39"
+checksum = "3a6c9af12842a67734c9a2e355436e5d03b22383ed60cf13cd0c18fbfe3dcbcf"
 dependencies = [
  "async-trait",
  "axum-core",
- "bitflags 1.3.2",
  "bytes",
  "futures-util",
- "http",
- "http-body",
- "hyper",
+ "http 1.1.0",
+ "http-body 1.0.1",
+ "http-body-util",
  "itoa",
  "matchit",
  "memchr",
@@ -165,21 +207,39 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.3.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
 dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http",
- "http-body",
+ "http 1.1.0",
+ "http-body 1.0.1",
+ "http-body-util",
  "mime",
+ "pin-project-lite",
  "rustversion",
+ "sync_wrapper",
  "tower-layer",
  "tower-service",
 ]
 
+[[package]]
+name = "backtrace"
+version = "0.3.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
+
 [[package]]
 name = "base16ct"
 version = "0.2.0"
@@ -194,9 +254,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64"
-version = "0.21.7"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64ct"
@@ -242,15 +302,18 @@ checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
 
 [[package]]
 name = "bytes"
-version = "1.4.0"
+version = "1.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
+checksum = "428d9aa8fbc0670b7b8d6030a7fadd0f86151cae55e4dbbece15f3780a3dfaf3"
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "812acba72f0a070b003d3697490d2b55b837230ae7c6c6497f05cc2ddbb8d938"
+dependencies = [
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
@@ -956,6 +1019,12 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "gimli"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -978,7 +1047,26 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "futures-util",
- "http",
+ "http 0.2.11",
+ "indexmap 2.1.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e8ac6999421f49a846c2d4411f337e53497d8ec55d67753beffa43c5d9205"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.1.0",
  "indexmap 2.1.0",
  "slab",
  "tokio",
@@ -1024,18 +1112,9 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.1"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "hex"
@@ -1082,6 +1161,17 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
 [[package]]
 name = "http-body"
 version = "0.4.5"
@@ -1089,7 +1179,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
 dependencies = [
  "bytes",
- "http",
+ "http 0.2.11",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http 1.1.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.1",
  "pin-project-lite",
 ]
 
@@ -1121,20 +1234,41 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2",
- "http",
- "http-body",
+ "h2 0.3.26",
+ "http 0.2.11",
+ "http-body 0.4.5",
  "httparse",
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "socket2 0.4.9",
  "tokio",
  "tower-service",
  "tracing",
  "want",
 ]
 
+[[package]]
+name = "hyper"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "h2 0.4.6",
+ "http 1.1.0",
+ "http-body 1.0.1",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
 [[package]]
 name = "hyper-rustls"
 version = "0.22.1"
@@ -1143,7 +1277,7 @@ checksum = "5f9f7a97316d44c0af9b0301e65010573a853a9fc97046d7331d7f6bc0fd5a64"
 dependencies = [
  "ct-logs",
  "futures-util",
- "hyper",
+ "hyper 0.14.24",
  "log",
  "rustls",
  "rustls-native-certs",
@@ -1154,14 +1288,15 @@ dependencies = [
 
 [[package]]
 name = "hyper-timeout"
-version = "0.4.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbb958482e8c7be4bc3cf272a766a2b0bf1a6755e7a6ae777f017a31d11b13b1"
+checksum = "3203a961e5c83b6f5498933e78b6b263e208c197b63e9c6c53cc82ffd3f63793"
 dependencies = [
- "hyper",
+ "hyper 1.4.1",
+ "hyper-util",
  "pin-project-lite",
  "tokio",
- "tokio-io-timeout",
+ "tower-service",
 ]
 
 [[package]]
@@ -1171,12 +1306,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
  "bytes",
- "hyper",
+ "hyper 0.14.24",
  "native-tls",
  "tokio",
  "tokio-native-tls",
 ]
 
+[[package]]
+name = "hyper-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41296eb09f183ac68eec06e03cdbea2e759633d4067b2f6552fc2e009bcad08b"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.1",
+ "hyper 1.4.1",
+ "pin-project-lite",
+ "socket2 0.5.7",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.53"
@@ -1265,7 +1419,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21b6b32576413a8e69b90e952e4a026476040d81017b80445deda5f2d3921857"
 dependencies = [
- "hermit-abi 0.3.1",
+ "hermit-abi 0.3.9",
  "io-lifetimes",
  "rustix",
  "windows-sys 0.45.0",
@@ -1363,16 +1517,25 @@ version = "0.3.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
 
+[[package]]
+name = "miniz_oxide"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
+dependencies = [
+ "adler",
+]
+
 [[package]]
 name = "mio"
-version = "0.8.11"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
 dependencies = [
+ "hermit-abi 0.3.9",
  "libc",
- "log",
  "wasi 0.11.0+wasi-snapshot-preview1",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1428,13 +1591,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "num_cpus"
-version = "1.15.0"
+name = "object"
+version = "0.36.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+checksum = "084f1a5821ac4c651660a94a7153d27ac9d8a53736203f58b31945ded098070a"
 dependencies = [
- "hermit-abi 0.2.6",
- "libc",
+ "memchr",
 ]
 
 [[package]]
@@ -1552,9 +1714,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.9"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
 
 [[package]]
 name = "pin-utils"
@@ -1609,12 +1771,12 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "prettyplease"
-version = "0.1.24"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ebcd279d20a4a0a2404a33056388e950504d891c855c7975b9a8fef75f3bf04"
+checksum = "8d3928fb5db768cb86f891ff014f0144589297e3c6a1aba6ed7cecfdace270c7"
 dependencies = [
  "proc-macro2",
- "syn 1.0.109",
+ "syn 2.0.46",
 ]
 
 [[package]]
@@ -1661,9 +1823,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.11.9"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
+checksum = "7b0487d90e047de87f984913713b85c601c05609aad5b0df4b4573fbf69aa13f"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -1671,44 +1833,43 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.11.9"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "119533552c9a7ffacc21e099c24a0ac8bb19c2a2a3f363de84cd9b844feab270"
+checksum = "0c1318b19085f08681016926435853bbf7858f9c082d0999b80550ff5d9abe15"
 dependencies = [
  "bytes",
  "heck 0.4.1",
  "itertools",
- "lazy_static",
  "log",
  "multimap",
+ "once_cell",
  "petgraph",
  "prettyplease",
  "prost",
  "prost-types",
  "regex",
- "syn 1.0.109",
+ "syn 2.0.46",
  "tempfile",
- "which",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.11.9"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5d2d8d10f3c6ded6da8b05b5fb3b8a5082514344d56c9f871412d29b4e075b4"
+checksum = "e9552f850d5f0964a4e4d0bf306459ac29323ddfbae05e35a7c0d35cb0803cc5"
 dependencies = [
  "anyhow",
  "itertools",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.46",
 ]
 
 [[package]]
 name = "prost-types"
-version = "0.11.9"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "213622a1460818959ac1181aaeb2dc9c7f63df720db7d788b3e24eacd1983e13"
+checksum = "4759aa0d3a6232fb8dbdb97b61de2c20047c68aca932c7ed76da9d788508d670"
 dependencies = [
  "prost",
 ]
@@ -1855,8 +2016,8 @@ dependencies = [
  "bytes",
  "crc32fast",
  "futures",
- "http",
- "hyper",
+ "http 0.2.11",
+ "hyper 0.14.24",
  "hyper-tls",
  "lazy_static",
  "log",
@@ -1879,7 +2040,7 @@ dependencies = [
  "chrono",
  "dirs-next",
  "futures",
- "hyper",
+ "hyper 0.14.24",
  "serde",
  "serde_json",
  "shlex",
@@ -1914,8 +2075,8 @@ dependencies = [
  "futures",
  "hex",
  "hmac 0.11.0",
- "http",
- "hyper",
+ "http 0.2.11",
+ "hyper 0.14.24",
  "log",
  "md-5",
  "percent-encoding",
@@ -1927,6 +2088,12 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "rustc-demangle"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.0"
@@ -2161,6 +2328,12 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
 [[package]]
 name = "socket2"
 version = "0.4.9"
@@ -2171,6 +2344,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "spin"
 version = "0.5.2"
@@ -2247,9 +2430,9 @@ dependencies = [
 
 [[package]]
 name = "sync_wrapper"
-version = "0.1.2"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
 
 [[package]]
 name = "tempfile"
@@ -2373,11 +2556,11 @@ dependencies = [
 name = "tink-gcpkms"
 version = "0.2.5"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "futures",
- "http",
- "hyper",
+ "http 0.2.11",
+ "hyper 0.14.24",
  "hyper-rustls",
  "lazy_static",
  "percent-encoding",
@@ -2427,7 +2610,7 @@ dependencies = [
 name = "tink-proto"
 version = "0.2.5"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "prost",
  "prost-build",
  "serde",
@@ -2487,7 +2670,7 @@ dependencies = [
 name = "tink-tests"
 version = "0.2.5"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "ed25519-dalek",
  "generic-array",
  "hex",
@@ -2530,42 +2713,30 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.26.0"
+version = "1.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03201d01c3c27a29c8a5cee5b55a93ddae1ccf6f08f65365c2c918f8c1b76f64"
+checksum = "e2b070231665d27ad9ec9b8df639893f46727666c6767db40317fbe920a5d998"
 dependencies = [
- "autocfg",
+ "backtrace",
  "bytes",
  "libc",
- "memchr",
  "mio",
- "num_cpus",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.5.7",
  "tokio-macros",
- "windows-sys 0.45.0",
-]
-
-[[package]]
-name = "tokio-io-timeout"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b74022ada614a1b4834de765f9bb43877f910cc8ce4be40e89042c9223a8bf"
-dependencies = [
- "pin-project-lite",
- "tokio",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "1.8.2"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d266c00fde287f55d3f1c3e96c500c362a2b8c695076ec180f27918820bc6df8"
+checksum = "693d596312e88961bc67d7f1f97af8a70227d9f90c31bba5806eec004978d752"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.46",
 ]
 
 [[package]]
@@ -2591,9 +2762,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.12"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fb52b74f05dbf495a8fba459fdc331812b96aa086d9eb78101fa0d4569c3313"
+checksum = "4f4e6ce100d0eb49a2734f8c0812bcd324cf357d21810932c5df6b96ef2b86f1"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -2616,24 +2787,26 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.9.2"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
+checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
 dependencies = [
+ "async-stream",
  "async-trait",
  "axum",
- "base64 0.21.7",
+ "base64 0.22.1",
  "bytes",
- "futures-core",
- "futures-util",
- "h2",
- "http",
- "http-body",
- "hyper",
+ "h2 0.4.6",
+ "http 1.1.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.4.1",
  "hyper-timeout",
+ "hyper-util",
  "percent-encoding",
  "pin-project",
  "prost",
+ "socket2 0.5.7",
  "tokio",
  "tokio-stream",
  "tower",
@@ -2644,15 +2817,16 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.8.4"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bf5e9b9c0f7e0a7c027dcfaba7b2c60816c7049171f679d99ee2ff65d0de8c4"
+checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
 dependencies = [
  "prettyplease",
  "proc-macro2",
  "prost-build",
+ "prost-types",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.46",
 ]
 
 [[package]]
@@ -2905,17 +3079,6 @@ dependencies = [
  "untrusted",
 ]
 
-[[package]]
-name = "which"
-version = "4.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2441c784c52b289a054b7201fc93253e288f094e2f4be9058343127c4226a269"
-dependencies = [
- "either",
- "libc",
- "once_cell",
-]
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -2971,15 +3134,6 @@ dependencies = [
  "windows-targets 0.42.1",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -3004,21 +3158,6 @@ dependencies = [
  "windows_x86_64_msvc 0.42.1",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm 0.48.5",
- "windows_aarch64_msvc 0.48.5",
- "windows_i686_gnu 0.48.5",
- "windows_i686_msvc 0.48.5",
- "windows_x86_64_gnu 0.48.5",
- "windows_x86_64_gnullvm 0.48.5",
- "windows_x86_64_msvc 0.48.5",
-]
-
 [[package]]
 name = "windows-targets"
 version = "0.52.4"
@@ -3040,12 +3179,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.4"
@@ -3058,12 +3191,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.4"
@@ -3076,12 +3203,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.4"
@@ -3094,12 +3215,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.4"
@@ -3112,12 +3227,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.4"
@@ -3130,12 +3239,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.4"
@@ -3148,12 +3251,6 @@ version = "0.42.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.4"
@@ -3175,8 +3272,8 @@ dependencies = [
  "base64 0.13.1",
  "chrono",
  "futures",
- "http",
- "hyper",
+ "http 0.2.11",
+ "hyper 0.14.24",
  "hyper-rustls",
  "log",
  "percent-encoding",
diff --git a/Cargo.toml b/Cargo.toml
index 1b9b789c1..f246f651e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,6 +25,7 @@ members = [
   "tests",
   "testing",
 ]
+resolver = "1"
 
 # Patch dependencies on tink crates so that they refer to the versions within this same repository.
 [patch.crates-io]
diff --git a/README.md b/README.md
index 558685f3c..59ed7aca4 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Tink in Rust
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://project-oak.github.io/tink-rust)
-![MSRV](https://img.shields.io/badge/rustc-1.60+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 [![CI Status](https://img.shields.io/github/actions/workflow/status/project-oak/tink-rust/ci.yml?branch=main&color=blue&style=for-the-badge)](https://github.com/project-oak/tink-rust/actions?query=workflow%3ACI)
 [![Interop Status](https://img.shields.io/github/actions/workflow/status/project-oak/tink-rust/crosstest.yml?branch=main&color=orange&label=interop&style=for-the-badge)](https://github.com/project-oak/tink-rust/actions?query=workflow%3Acrosstest)
 [![codecov](https://img.shields.io/codecov/c/github/project-oak/tink-rust?style=for-the-badge)](https://codecov.io/gh/project-oak/tink-rust)
diff --git a/aead/CHANGELOG.md b/aead/CHANGELOG.md
index 2d10e355c..6dd69202c 100644
--- a/aead/CHANGELOG.md
+++ b/aead/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/aead/README.md b/aead/README.md
index fb188c0a7..1a220c8db 100644
--- a/aead/README.md
+++ b/aead/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Authenticated Encryption with Additional Data
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-aead)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides authenticated encryption with additional data (AEAD) functionality, as described in the upstream
 [Tink documentation](https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#authenticated-encryption-with-associated-data).
diff --git a/aead/src/aes_ctr_hmac_aead_key_manager.rs b/aead/src/aes_ctr_hmac_aead_key_manager.rs
index f1903f3d7..ee174a67f 100644
--- a/aead/src/aes_ctr_hmac_aead_key_manager.rs
+++ b/aead/src/aes_ctr_hmac_aead_key_manager.rs
@@ -17,6 +17,7 @@
 //! Key manager for AES-CTR-HMAC keys.
 
 use crate::subtle;
+use std::convert::TryFrom;
 use tink_core::{utils::wrap_err, TinkError};
 use tink_proto::{prost::Message, HashType};
 
@@ -155,8 +156,8 @@ fn validate_hmac_key(
         .params
         .as_ref()
         .ok_or_else(|| TinkError::new("AesCtrHmacAeadKeyManager: no HMAC params"))?;
-    let hash = HashType::from_i32(hmac_params.hash)
-        .ok_or_else(|| TinkError::new("AesCtrHmacAeadKeyManager: unknown hash"))?;
+    let hash = HashType::try_from(hmac_params.hash)
+        .map_err(|_e| TinkError::new("AesCtrHmacAeadKeyManager: unknown hash"))?;
 
     Ok((hmac_key, hmac_params, hash))
 }
@@ -203,12 +204,12 @@ fn validate_key_format(
         .into());
     }
 
-    let tag_size = match HashType::from_i32(hmac_params.hash) {
-        Some(HashType::Sha1) => 20,
-        Some(HashType::Sha224) => 28,
-        Some(HashType::Sha256) => 32,
-        Some(HashType::Sha384) => 48,
-        Some(HashType::Sha512) => 64,
+    let tag_size = match HashType::try_from(hmac_params.hash) {
+        Ok(HashType::Sha1) => 20,
+        Ok(HashType::Sha224) => 28,
+        Ok(HashType::Sha256) => 32,
+        Ok(HashType::Sha384) => 48,
+        Ok(HashType::Sha512) => 64,
         _ => {
             return Err(format!(
                 "AesCtrHmacAeadKeyManager: invalid HmacParams: hash_type {:?} not supported",
@@ -225,5 +226,5 @@ fn validate_key_format(
         )
         .into());
     }
-    Ok((aes_ctr_format.clone(), hmac_key_format.clone()))
+    Ok((*aes_ctr_format, *hmac_key_format))
 }
diff --git a/core/CHANGELOG.md b/core/CHANGELOG.md
index 131fa0ef1..fb656f580 100644
--- a/core/CHANGELOG.md
+++ b/core/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.3.0 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 - Make `tink_core::TinkError` implement `Send`; this is a breaking change, as it requires a `Send` bound on wrapped errors
 
diff --git a/core/README.md b/core/README.md
index bbc08115c..89e313b57 100644
--- a/core/README.md
+++ b/core/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Core Library
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-core)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate holds common code for the Rust version of Tink.
 
diff --git a/core/src/cryptofmt/mod.rs b/core/src/cryptofmt/mod.rs
index 7434f61df..40302e43b 100644
--- a/core/src/cryptofmt/mod.rs
+++ b/core/src/cryptofmt/mod.rs
@@ -17,6 +17,7 @@
 //! Provides constants and convenience methods that define the format of ciphertexts and signatures.
 
 use crate::TinkError;
+use std::convert::TryFrom;
 use tink_proto::OutputPrefixType;
 
 /// Prefix size of Tink and Legacy key types.
@@ -44,17 +45,19 @@ pub const RAW_PREFIX: Vec<u8> = Vec::new();
 /// prefix can be either empty (for RAW-type prefix), or consists of a 1-byte indicator of the type
 /// of the prefix, followed by 4 bytes of the key ID in big endian encoding.
 pub fn output_prefix(key: &tink_proto::keyset::Key) -> Result<Vec<u8>, TinkError> {
-    match OutputPrefixType::from_i32(key.output_prefix_type) {
-        Some(OutputPrefixType::Legacy) | Some(OutputPrefixType::Crunchy) => Ok(
-            create_output_prefix(LEGACY_PREFIX_SIZE, LEGACY_START_BYTE, key.key_id),
-        ),
-        Some(OutputPrefixType::Tink) => Ok(create_output_prefix(
+    match OutputPrefixType::try_from(key.output_prefix_type) {
+        Ok(OutputPrefixType::Legacy) | Ok(OutputPrefixType::Crunchy) => Ok(create_output_prefix(
+            LEGACY_PREFIX_SIZE,
+            LEGACY_START_BYTE,
+            key.key_id,
+        )),
+        Ok(OutputPrefixType::Tink) => Ok(create_output_prefix(
             TINK_PREFIX_SIZE,
             TINK_START_BYTE,
             key.key_id,
         )),
-        Some(OutputPrefixType::Raw) => Ok(RAW_PREFIX),
-        Some(OutputPrefixType::UnknownPrefix) | None => {
+        Ok(OutputPrefixType::Raw) => Ok(RAW_PREFIX),
+        Ok(OutputPrefixType::UnknownPrefix) | Err(_) => {
             Err("cryptofmt: unknown output prefix type".into())
         }
     }
diff --git a/core/src/keyset/handle.rs b/core/src/keyset/handle.rs
index e453b0250..00ba79bba 100644
--- a/core/src/keyset/handle.rs
+++ b/core/src/keyset/handle.rs
@@ -17,7 +17,7 @@
 //! Handle wrapper for keysets.
 
 use crate::{utils::wrap_err, TinkError};
-use std::sync::Arc;
+use std::{convert::TryFrom, sync::Arc};
 use tink_proto::{key_data::KeyMaterialType, prost::Message, Keyset, KeysetInfo};
 
 /// `Handle` provides access to a [`Keyset`] protobuf, to limit the exposure
@@ -217,13 +217,13 @@ impl Handle {
         for k in &self.ks.key {
             match &k.key_data {
                 None => return Err("invalid keyset".into()),
-                Some(kd) => match KeyMaterialType::from_i32(kd.key_material_type) {
-                    Some(KeyMaterialType::UnknownKeymaterial) => result = true,
-                    Some(KeyMaterialType::Symmetric) => result = true,
-                    Some(KeyMaterialType::AsymmetricPrivate) => result = true,
-                    Some(KeyMaterialType::AsymmetricPublic) => {}
-                    Some(KeyMaterialType::Remote) => {}
-                    None => return Err("invalid key material type".into()),
+                Some(kd) => match KeyMaterialType::try_from(kd.key_material_type) {
+                    Ok(KeyMaterialType::UnknownKeymaterial) => result = true,
+                    Ok(KeyMaterialType::Symmetric) => result = true,
+                    Ok(KeyMaterialType::AsymmetricPrivate) => result = true,
+                    Ok(KeyMaterialType::AsymmetricPublic) => {}
+                    Ok(KeyMaterialType::Remote) => {}
+                    Err(_) => return Err("invalid key material type".into()),
                 },
             }
         }
@@ -264,9 +264,9 @@ fn validate_keyset(ks: Keyset) -> Result<Keyset, TinkError> {
         match &k.key_data {
             None if k.status == tink_proto::KeyStatusType::Destroyed as i32 => {}
             None => return Err("invalid keyset".into()),
-            Some(kd) => match KeyMaterialType::from_i32(kd.key_material_type) {
-                Some(_) => {}
-                None => return Err("invalid key material type".into()),
+            Some(kd) => match KeyMaterialType::try_from(kd.key_material_type) {
+                Ok(_) => {}
+                Err(_) => return Err("invalid key material type".into()),
             },
         }
     }
diff --git a/core/src/keyset/manager.rs b/core/src/keyset/manager.rs
index 89c12503a..0d2999325 100644
--- a/core/src/keyset/manager.rs
+++ b/core/src/keyset/manager.rs
@@ -18,6 +18,7 @@
 
 use crate::{utils::wrap_err, KeyId, TinkError};
 use rand::Rng;
+use std::convert::TryFrom;
 use tink_proto::{KeyStatusType, OutputPrefixType};
 
 /// Manager manages a [`Keyset`](tink_proto::Keyset)-proto, with convenience methods that rotate,
@@ -59,11 +60,11 @@ impl Manager {
         let key_data = crate::registry::new_key_data(kt)
             .map_err(|e| wrap_err("keyset::Manager: cannot create KeyData", e))?;
         let key_id = self.new_key_id();
-        let output_prefix_type = match OutputPrefixType::from_i32(kt.output_prefix_type) {
-            None | Some(OutputPrefixType::UnknownPrefix) => {
+        let output_prefix_type = match OutputPrefixType::try_from(kt.output_prefix_type) {
+            Err(_) | Ok(OutputPrefixType::UnknownPrefix) => {
                 return Err("keyset::Manager: unknown output prefix type".into())
             }
-            Some(p) => p,
+            Ok(p) => p,
         };
         let key = tink_proto::keyset::Key {
             key_data: Some(key_data),
@@ -90,8 +91,8 @@ impl Manager {
     pub fn enable(&mut self, key_id: KeyId) -> Result<(), TinkError> {
         for key in &mut self.ks.key {
             if key.key_id == key_id {
-                return match KeyStatusType::from_i32(key.status) {
-                    Some(KeyStatusType::Enabled) | Some(KeyStatusType::Disabled) => {
+                return match KeyStatusType::try_from(key.status) {
+                    Ok(KeyStatusType::Enabled) | Ok(KeyStatusType::Disabled) => {
                         key.status = KeyStatusType::Enabled as i32;
                         Ok(())
                     }
@@ -115,8 +116,8 @@ impl Manager {
         }
         for key in &mut self.ks.key {
             if key.key_id == key_id {
-                return match KeyStatusType::from_i32(key.status) {
-                    Some(KeyStatusType::Enabled) | Some(KeyStatusType::Disabled) => {
+                return match KeyStatusType::try_from(key.status) {
+                    Ok(KeyStatusType::Enabled) | Ok(KeyStatusType::Disabled) => {
                         key.status = KeyStatusType::Disabled as i32;
                         Ok(())
                     }
@@ -141,10 +142,10 @@ impl Manager {
         }
         for key in &mut self.ks.key {
             if key.key_id == key_id {
-                return match KeyStatusType::from_i32(key.status) {
-                    Some(KeyStatusType::Enabled)
-                    | Some(KeyStatusType::Disabled)
-                    | Some(KeyStatusType::Destroyed) => {
+                return match KeyStatusType::try_from(key.status) {
+                    Ok(KeyStatusType::Enabled)
+                    | Ok(KeyStatusType::Disabled)
+                    | Ok(KeyStatusType::Destroyed) => {
                         key.key_data = None;
                         key.status = KeyStatusType::Destroyed as i32;
                         Ok(())
@@ -186,8 +187,8 @@ impl Manager {
     pub fn set_primary(&mut self, key_id: KeyId) -> Result<(), TinkError> {
         for key in &self.ks.key {
             if key.key_id == key_id {
-                return match KeyStatusType::from_i32(key.status) {
-                    Some(KeyStatusType::Enabled) => {
+                return match KeyStatusType::try_from(key.status) {
+                    Ok(KeyStatusType::Enabled) => {
                         self.ks.primary_key_id = key_id;
                         Ok(())
                     }
diff --git a/core/src/prf.rs b/core/src/prf.rs
index a54a2efb2..de7fe9411 100644
--- a/core/src/prf.rs
+++ b/core/src/prf.rs
@@ -24,9 +24,11 @@
 ///   * It is indistinguishable from a random function: Given the evaluation of n different inputs,
 ///     an attacker cannot distinguish between the PRF and random bytes on an input different from
 ///     the n that are known.
+///
 /// Use cases for PRF are deterministic redaction of PII, keyed hash functions,
 /// creating sub IDs that do not allow joining with the original dataset without
 /// knowing the key.
+///
 /// While PRFs can be used in order to prove authenticity of a message, using the
 /// [`Mac`](crate::Mac) interface is recommended for that use case, as it has support for
 /// verification, avoiding the security problems that often happen during
diff --git a/core/src/primitiveset/mod.rs b/core/src/primitiveset/mod.rs
index b9738d7aa..c4e9151e1 100644
--- a/core/src/primitiveset/mod.rs
+++ b/core/src/primitiveset/mod.rs
@@ -21,7 +21,10 @@
 //! primary" one.
 
 use crate::utils::{wrap_err, TinkError};
-use std::collections::{hash_map, HashMap};
+use std::{
+    collections::{hash_map, HashMap},
+    convert::TryFrom,
+};
 
 /// `Entry` represents a single entry in the keyset. In addition to the actual
 /// primitive, it holds the identifier and status of the primitive.
@@ -111,10 +114,10 @@ impl PrimitiveSet {
             key.key_id,
             p,
             &prefix,
-            tink_proto::OutputPrefixType::from_i32(key.output_prefix_type)
-                .ok_or_else(|| TinkError::new("invalid key prefix type"))?,
-            tink_proto::KeyStatusType::from_i32(key.status)
-                .ok_or_else(|| TinkError::new("invalid key status"))?,
+            tink_proto::OutputPrefixType::try_from(key.output_prefix_type)
+                .map_err(|_e| TinkError::new("invalid key prefix type"))?,
+            tink_proto::KeyStatusType::try_from(key.status)
+                .map_err(|_e| TinkError::new("invalid key status"))?,
         );
         let retval = entry.clone();
         match self.entries.entry(prefix) {
diff --git a/daead/CHANGELOG.md b/daead/CHANGELOG.md
index 5ca7f3005..c3e5e897d 100644
--- a/daead/CHANGELOG.md
+++ b/daead/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/daead/README.md b/daead/README.md
index 4d00ce1ca..1833cb103 100644
--- a/daead/README.md
+++ b/daead/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Deterministic Authenticated Encryption with Additional Data
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-daead)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides deterministic authenticated encryption with additional data (DAEAD) functionality, as described in
 the upstream [Tink
diff --git a/deny.toml b/deny.toml
index dae99818b..f02064585 100644
--- a/deny.toml
+++ b/deny.toml
@@ -23,8 +23,10 @@ ignore = [
     "RUSTSEC-2022-0071",
     # ansi_term is Unmaintained (via structopt(0.3.26)).
     "RUSTSEC-2021-0139",
-    # proc-macro-error is Unmaintained (via structopt-derive(0.4.18)
+    # proc-macro-error is Unmaintained (via structopt-derive(0.4.18)).
     "RUSTSEC-2024-0370",
+    # atty is Unmaintained (via structopt(v0.3.26)).
+    "RUSTSEC-2024-0375",
     # No use of externally-provided WebPKI chains.
     "RUSTSEC-2023-0052",
     # TODO(692): upgrade tink-gcp-kms dependencies
@@ -54,6 +56,21 @@ version = "0.9.9"
 [[bans.skip]]
 name = "bitflags"
 version = "1.3.2"
+[[bans.skip]]
+name = "h2"
+version = "0.3.26"
+[[bans.skip]]
+name = "http"
+version = "0.2.11"
+[[bans.skip]]
+name = "http-body"
+version = "0.4.5"
+[[bans.skip]]
+name = "hyper"
+version = "0.14.24"
+[[bans.skip]]
+name = "socket2"
+version = "0.4.9"
 
 # structopt(0.3.26) => structopt-derive(0.4.18) => heck(0.3.*)
 [[bans.skip]]
diff --git a/hybrid/CHANGELOG.md b/hybrid/CHANGELOG.md
index 2c911ed88..ea3d08ec6 100644
--- a/hybrid/CHANGELOG.md
+++ b/hybrid/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/hybrid/README.md b/hybrid/README.md
index 71b5bd7b8..0e002014d 100644
--- a/hybrid/README.md
+++ b/hybrid/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Hybrid Encryption
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-hybrid)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides hybrid encryption functionality, as described in the upstream
 [Tink documentation](https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#hybrid-encryption).
diff --git a/hybrid/src/ecies_aead_hkdf_private_key_manager.rs b/hybrid/src/ecies_aead_hkdf_private_key_manager.rs
index e8bcd7d1c..ddb04d2f3 100644
--- a/hybrid/src/ecies_aead_hkdf_private_key_manager.rs
+++ b/hybrid/src/ecies_aead_hkdf_private_key_manager.rs
@@ -16,6 +16,7 @@
 
 //! Key manager for ECIES-AEAD-HKDF private keys.
 
+use std::convert::TryFrom;
 use tink_core::{utils::wrap_err, TinkError};
 use tink_proto::{
     prost::Message, EcPointFormat, EciesHkdfKemParams, EllipticCurveType, HashType, KeyTemplate,
@@ -195,18 +196,18 @@ pub(crate) fn check_ecies_aead_hkdf_params(
         .as_ref()
         .ok_or_else(|| TinkError::new("no dem_params"))?;
 
-    let curve = EllipticCurveType::from_i32(kem_params.curve_type)
+    let curve = EllipticCurveType::try_from(kem_params.curve_type)
         .unwrap_or(EllipticCurveType::UnknownCurve);
 
-    let hkdf_hash = match HashType::from_i32(kem_params.hkdf_hash_type) {
-        Some(HashType::UnknownHash) => return Err("unsupported HKDF hash".into()),
-        Some(h) => h,
-        None => return Err("unknown HKDF hash".into()),
+    let hkdf_hash = match HashType::try_from(kem_params.hkdf_hash_type) {
+        Ok(HashType::UnknownHash) => return Err("unsupported HKDF hash".into()),
+        Ok(h) => h,
+        Err(_) => return Err("unknown HKDF hash".into()),
     };
-    let ec_point_format = match EcPointFormat::from_i32(params.ec_point_format) {
-        Some(EcPointFormat::UnknownFormat) => return Err("unknown EC point format".into()),
-        Some(f) => f,
-        None => return Err("unknown EC point format".into()),
+    let ec_point_format = match EcPointFormat::try_from(params.ec_point_format) {
+        Ok(EcPointFormat::UnknownFormat) => return Err("unknown EC point format".into()),
+        Ok(f) => f,
+        Err(_) => return Err("unknown EC point format".into()),
     };
     let aead_dem = dem_params
         .aead_dem
diff --git a/integration/awskms/CHANGELOG.md b/integration/awskms/CHANGELOG.md
index 712c0eeab..cf4658d81 100644
--- a/integration/awskms/CHANGELOG.md
+++ b/integration/awskms/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/integration/awskms/README.md b/integration/awskms/README.md
index d4385ed1b..3cffe26cf 100644
--- a/integration/awskms/README.md
+++ b/integration/awskms/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: AWS-KMS integration
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-awskms)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides functionality for integrating Tink with [AWS KMS](https://aws.amazon.com/kms/).
 
diff --git a/integration/gcpkms/CHANGELOG.md b/integration/gcpkms/CHANGELOG.md
index 5e284f1c2..65a0e38b8 100644
--- a/integration/gcpkms/CHANGELOG.md
+++ b/integration/gcpkms/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/integration/gcpkms/Cargo.toml b/integration/gcpkms/Cargo.toml
index 6e3a419e1..57ecca1f7 100644
--- a/integration/gcpkms/Cargo.toml
+++ b/integration/gcpkms/Cargo.toml
@@ -12,7 +12,7 @@ keywords = ["cryptography", "tink", "kms", "gcp"]
 categories = ["cryptography"]
 
 [dependencies]
-base64 = "^0.21"
+base64 = "^0.22"
 chrono = "^0.4"
 futures = "^0.3"
 http = "^0.2"
diff --git a/integration/gcpkms/README.md b/integration/gcpkms/README.md
index 16836b58f..740eb488f 100644
--- a/integration/gcpkms/README.md
+++ b/integration/gcpkms/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: GCP-KMS integration
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-gcpkms)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides functionality for integrating Tink with [Google Cloud KMS](https://cloud.google.com/kms/docs/quickstart).
 
diff --git a/mac/CHANGELOG.md b/mac/CHANGELOG.md
index c85dfefc3..9ed827c02 100644
--- a/mac/CHANGELOG.md
+++ b/mac/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/mac/README.md b/mac/README.md
index 3ba44fc8e..7eeb3139b 100644
--- a/mac/README.md
+++ b/mac/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Message Authentication Code
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-mac)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides message authentication code (MAC) functionality, as described in the upstream
 [Tink documentation](https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#message-authentication-code).
diff --git a/mac/src/hmac_key_manager.rs b/mac/src/hmac_key_manager.rs
index 38ad28401..efdd3a7fe 100644
--- a/mac/src/hmac_key_manager.rs
+++ b/mac/src/hmac_key_manager.rs
@@ -16,6 +16,7 @@
 
 //! Key manager for AES-CMAC keys for HMAC.
 
+use std::convert::TryFrom;
 use tink_core::{utils::wrap_err, TinkError};
 use tink_proto::{prost::Message, HashType};
 
@@ -43,7 +44,7 @@ impl tink_core::registry::KeyManager for HmacKeyManager {
             None => return Err("HmacKeyManager: no key params".into()),
             Some(p) => p,
         };
-        let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+        let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
         match crate::subtle::Hmac::new(hash, &key.key_value, params.tag_size as usize) {
             Ok(p) => Ok(tink_core::Primitive::Mac(Box::new(p))),
             Err(e) => Err(wrap_err("HmacKeyManager: cannot create new primitive", e)),
@@ -90,7 +91,7 @@ fn validate_key(key: &tink_proto::HmacKey) -> Result<(), TinkError> {
     match &key.params {
         None => Err("HmacKeyManager: missing HMAC params".into()),
         Some(params) => {
-            let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+            let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
             crate::subtle::validate_hmac_params(hash, key_size, params.tag_size as usize)
         }
     }
@@ -101,7 +102,7 @@ fn validate_key_format(format: &tink_proto::HmacKeyFormat) -> Result<(), TinkErr
     match &format.params {
         None => Err("missing HMAC params".into()),
         Some(params) => {
-            let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+            let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
             crate::subtle::validate_hmac_params(
                 hash,
                 format.key_size as usize,
diff --git a/prf/CHANGELOG.md b/prf/CHANGELOG.md
index 3ce7d393b..2c5f183fc 100644
--- a/prf/CHANGELOG.md
+++ b/prf/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/prf/README.md b/prf/README.md
index 6a0a6446c..eefb3ea76 100644
--- a/prf/README.md
+++ b/prf/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Pseudo-Random Functions
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-prf)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides pseudo-random function (PRF) functionality, as described in the upstream
 [Tink documentation](https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#pseudo-random-function-families).
diff --git a/prf/src/hkdf_prf_key_manager.rs b/prf/src/hkdf_prf_key_manager.rs
index 9a6846f72..0161a1c47 100644
--- a/prf/src/hkdf_prf_key_manager.rs
+++ b/prf/src/hkdf_prf_key_manager.rs
@@ -17,6 +17,7 @@
 //! Key manager for HKDF keys for PRF.
 
 use crate::subtle;
+use std::convert::TryFrom;
 use tink_core::{utils::wrap_err, TinkError};
 use tink_proto::{prost::Message, HashType};
 
@@ -91,7 +92,7 @@ fn validate_key(
         None => return Err("HkdfPrfKeyManager: no key params".into()),
         Some(p) => p,
     };
-    let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+    let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
     subtle::validate_hkdf_prf_params(hash, key_size, &params.salt)?;
     Ok((params.clone(), hash))
 }
@@ -102,6 +103,6 @@ fn validate_key_format(format: &tink_proto::HkdfPrfKeyFormat) -> Result<(), Tink
         .params
         .as_ref()
         .ok_or_else(|| TinkError::new("no key params"))?;
-    let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+    let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
     subtle::validate_hkdf_prf_params(hash, format.key_size as usize, &params.salt)
 }
diff --git a/prf/src/hmac_prf_key_manager.rs b/prf/src/hmac_prf_key_manager.rs
index 698f848ed..36e04543c 100644
--- a/prf/src/hmac_prf_key_manager.rs
+++ b/prf/src/hmac_prf_key_manager.rs
@@ -17,6 +17,7 @@
 //! Key manager for HMAC keys for PRF.
 
 use crate::subtle;
+use std::convert::TryFrom;
 use tink_core::{utils::wrap_err, TinkError};
 use tink_proto::{prost::Message, HashType};
 
@@ -89,9 +90,9 @@ fn validate_key(
         None => return Err("no key params".into()),
         Some(p) => p,
     };
-    let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+    let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
     subtle::validate_hmac_prf_params(hash, key_size)?;
-    Ok((params.clone(), hash))
+    Ok((*params, hash))
 }
 
 /// Validates the given [`HmacPrfKeyFormat`](tink_proto::HmacPrfKeyFormat).
@@ -100,6 +101,6 @@ fn validate_key_format(format: &tink_proto::HmacPrfKeyFormat) -> Result<(), Tink
         .params
         .as_ref()
         .ok_or_else(|| TinkError::new("no params"))?;
-    let hash = HashType::from_i32(params.hash).unwrap_or(HashType::UnknownHash);
+    let hash = HashType::try_from(params.hash).unwrap_or(HashType::UnknownHash);
     subtle::validate_hmac_prf_params(hash, format.key_size as usize)
 }
diff --git a/proto/CHANGELOG.md b/proto/CHANGELOG.md
index adc8087e6..c206f8539 100644
--- a/proto/CHANGELOG.md
+++ b/proto/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/proto/Cargo.toml b/proto/Cargo.toml
index 47cdf12b7..f708bc4d9 100644
--- a/proto/Cargo.toml
+++ b/proto/Cargo.toml
@@ -17,12 +17,12 @@ default = []
 json = ["base64", "serde"]
 
 [dependencies]
-base64 = { version = "^0.21", optional = true }
-prost = "^0.11"
+base64 = { version = "^0.22", optional = true }
+prost = "^0.13"
 serde = { version = "^1.0.203", features = ["derive"], optional = true }
 
 [build-dependencies]
-prost-build = "^0.11"
+prost-build = "^0.13"
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/proto/README.md b/proto/README.md
index bc5daf4db..4ab0fbe04 100644
--- a/proto/README.md
+++ b/proto/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Protobuf Definitions
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-proto)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate holds Rust structures auto-generated (using [prost](https://docs.rs/prost)) from the protocol
 buffer message definitions in the `proto/` subdirectory.  These `.proto` files are copies from
diff --git a/proto/src/codegen/google.crypto.tink.rs b/proto/src/codegen/google.crypto.tink.rs
index 12c1f8c01..197cc5013 100644
--- a/proto/src/codegen/google.crypto.tink.rs
+++ b/proto/src/codegen/google.crypto.tink.rs
@@ -1,11 +1,10 @@
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+// This file is @generated by prost-build.
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCmacParams {
     #[prost(uint32, tag = "1")]
     pub tag_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCmacKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCmacKey {
     #[prost(uint32, tag = "1")]
@@ -15,8 +14,7 @@ pub struct AesCmacKey {
     #[prost(message, optional, tag = "3")]
     pub params: ::core::option::Option<AesCmacParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCmacKeyFormat {
     #[prost(uint32, tag = "1")]
     pub key_size: u32,
@@ -24,7 +22,6 @@ pub struct AesCmacKeyFormat {
     pub params: ::core::option::Option<AesCmacParams>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCmacPrfKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCmacPrfKey {
     #[prost(uint32, tag = "1")]
@@ -32,22 +29,19 @@ pub struct AesCmacPrfKey {
     #[prost(bytes = "vec", tag = "2")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCmacPrfKeyFormat {
     #[prost(uint32, tag = "2")]
     pub version: u32,
     #[prost(uint32, tag = "1")]
     pub key_size: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrParams {
     #[prost(uint32, tag = "1")]
     pub iv_size: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<AesCtrParams>,
@@ -55,7 +49,6 @@ pub struct AesCtrKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCtrKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCtrKey {
     #[prost(uint32, tag = "1")]
@@ -81,11 +74,11 @@ impl EllipticCurveType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            EllipticCurveType::UnknownCurve => "UNKNOWN_CURVE",
-            EllipticCurveType::NistP256 => "NIST_P256",
-            EllipticCurveType::NistP384 => "NIST_P384",
-            EllipticCurveType::NistP521 => "NIST_P521",
-            EllipticCurveType::Curve25519 => "CURVE25519",
+            Self::UnknownCurve => "UNKNOWN_CURVE",
+            Self::NistP256 => "NIST_P256",
+            Self::NistP384 => "NIST_P384",
+            Self::NistP521 => "NIST_P521",
+            Self::Curve25519 => "CURVE25519",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -117,12 +110,10 @@ impl EcPointFormat {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            EcPointFormat::UnknownFormat => "UNKNOWN_FORMAT",
-            EcPointFormat::Uncompressed => "UNCOMPRESSED",
-            EcPointFormat::Compressed => "COMPRESSED",
-            EcPointFormat::DoNotUseCrunchyUncompressed => {
-                "DO_NOT_USE_CRUNCHY_UNCOMPRESSED"
-            }
+            Self::UnknownFormat => "UNKNOWN_FORMAT",
+            Self::Uncompressed => "UNCOMPRESSED",
+            Self::Compressed => "COMPRESSED",
+            Self::DoNotUseCrunchyUncompressed => "DO_NOT_USE_CRUNCHY_UNCOMPRESSED",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -155,12 +146,12 @@ impl HashType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            HashType::UnknownHash => "UNKNOWN_HASH",
-            HashType::Sha1 => "SHA1",
-            HashType::Sha384 => "SHA384",
-            HashType::Sha256 => "SHA256",
-            HashType::Sha512 => "SHA512",
-            HashType::Sha224 => "SHA224",
+            Self::UnknownHash => "UNKNOWN_HASH",
+            Self::Sha1 => "SHA1",
+            Self::Sha384 => "SHA384",
+            Self::Sha256 => "SHA256",
+            Self::Sha512 => "SHA512",
+            Self::Sha224 => "SHA224",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -176,8 +167,7 @@ impl HashType {
         }
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacParams {
     /// HashType is an enum.
     #[prost(enumeration = "HashType", tag = "1")]
@@ -186,7 +176,6 @@ pub struct HmacParams {
     pub tag_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.HmacKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HmacKey {
     #[prost(uint32, tag = "1")]
@@ -196,8 +185,7 @@ pub struct HmacKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<HmacParams>,
@@ -206,8 +194,7 @@ pub struct HmacKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacAeadKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub aes_ctr_key_format: ::core::option::Option<AesCtrKeyFormat>,
@@ -215,7 +202,6 @@ pub struct AesCtrHmacAeadKeyFormat {
     pub hmac_key_format: ::core::option::Option<HmacKeyFormat>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCtrHmacAeadKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacAeadKey {
     #[prost(uint32, tag = "1")]
@@ -225,8 +211,7 @@ pub struct AesCtrHmacAeadKey {
     #[prost(message, optional, tag = "3")]
     pub hmac_key: ::core::option::Option<HmacKey>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacStreamingParams {
     #[prost(uint32, tag = "1")]
     pub ciphertext_segment_size: u32,
@@ -240,8 +225,7 @@ pub struct AesCtrHmacStreamingParams {
     #[prost(message, optional, tag = "4")]
     pub hmac_params: ::core::option::Option<HmacParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacStreamingKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
@@ -252,7 +236,6 @@ pub struct AesCtrHmacStreamingKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCtrHmacStreamingKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacStreamingKey {
     #[prost(uint32, tag = "1")]
@@ -264,15 +247,13 @@ pub struct AesCtrHmacStreamingKey {
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
 /// only allowing tag size in bytes = 16
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesEaxParams {
     /// possible value is 12 or 16 bytes.
     #[prost(uint32, tag = "1")]
     pub iv_size: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesEaxKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<AesEaxParams>,
@@ -280,7 +261,6 @@ pub struct AesEaxKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesEaxKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesEaxKey {
     #[prost(uint32, tag = "1")]
@@ -292,8 +272,7 @@ pub struct AesEaxKey {
 }
 /// only allowing IV size in bytes = 12 and tag size in bytes = 16
 /// Thus, accept no params.
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmKeyFormat {
     #[prost(uint32, tag = "2")]
     pub key_size: u32,
@@ -301,7 +280,6 @@ pub struct AesGcmKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesGcmKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesGcmKey {
     #[prost(uint32, tag = "1")]
@@ -309,8 +287,7 @@ pub struct AesGcmKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmHkdfStreamingParams {
     #[prost(uint32, tag = "1")]
     pub ciphertext_segment_size: u32,
@@ -320,8 +297,7 @@ pub struct AesGcmHkdfStreamingParams {
     #[prost(enumeration = "HashType", tag = "3")]
     pub hkdf_hash_type: i32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmHkdfStreamingKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
@@ -332,7 +308,6 @@ pub struct AesGcmHkdfStreamingKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesGcmHkdfStreamingKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesGcmHkdfStreamingKey {
     #[prost(uint32, tag = "1")]
@@ -344,8 +319,7 @@ pub struct AesGcmHkdfStreamingKey {
 }
 /// The only allowed IV size is 12 bytes and tag size is 16 bytes.
 /// Thus, accept no params.
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmSivKeyFormat {
     #[prost(uint32, tag = "2")]
     pub key_size: u32,
@@ -353,7 +327,6 @@ pub struct AesGcmSivKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesGcmSivKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesGcmSivKey {
     #[prost(uint32, tag = "1")]
@@ -361,8 +334,7 @@ pub struct AesGcmSivKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesSivKeyFormat {
     /// Only valid value is: 64.
     #[prost(uint32, tag = "1")]
@@ -371,7 +343,6 @@ pub struct AesSivKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesSivKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesSivKey {
     #[prost(uint32, tag = "1")]
@@ -380,13 +351,11 @@ pub struct AesSivKey {
     #[prost(bytes = "vec", tag = "2")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct ChaCha20Poly1305KeyFormat {}
 /// key_type: type.googleapis.com/google.crypto.tink.ChaCha20Poly1305.
 /// This key type actually implements ChaCha20Poly1305 as described
 /// at <https://tools.ietf.org/html/rfc7539#section-2.8.>
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct ChaCha20Poly1305Key {
     #[prost(uint32, tag = "1")]
@@ -397,7 +366,6 @@ pub struct ChaCha20Poly1305Key {
 /// An entry that describes a key type to be used with Tink library,
 /// specifying the corresponding primitive, key manager, and deprecation status.
 /// All fields are required.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeyTypeEntry {
     /// E.g. “Aead”, “Mac”, ... (case-insensitive)
@@ -419,7 +387,6 @@ pub struct KeyTypeEntry {
 /// A complete configuration of Tink library: a list of key types
 /// to be available via the Registry after initialization.
 /// All fields are required.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RegistryConfig {
     #[prost(string, tag = "1")]
@@ -428,8 +395,7 @@ pub struct RegistryConfig {
     pub entry: ::prost::alloc::vec::Vec<KeyTypeEntry>,
 }
 /// Protos for Ecdsa.
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct EcdsaParams {
     /// Required.
     #[prost(enumeration = "HashType", tag = "1")]
@@ -442,7 +408,6 @@ pub struct EcdsaParams {
     pub encoding: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.EcdsaPublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EcdsaPublicKey {
     /// Required.
@@ -463,7 +428,6 @@ pub struct EcdsaPublicKey {
     pub y: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.EcdsaPrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EcdsaPrivateKey {
     /// Required.
@@ -477,8 +441,7 @@ pub struct EcdsaPrivateKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct EcdsaKeyFormat {
     /// Required.
     #[prost(message, optional, tag = "2")]
@@ -507,9 +470,9 @@ impl EcdsaSignatureEncoding {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            EcdsaSignatureEncoding::UnknownEncoding => "UNKNOWN_ENCODING",
-            EcdsaSignatureEncoding::IeeeP1363 => "IEEE_P1363",
-            EcdsaSignatureEncoding::Der => "DER",
+            Self::UnknownEncoding => "UNKNOWN_ENCODING",
+            Self::IeeeP1363 => "IEEE_P1363",
+            Self::Der => "DER",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -522,7 +485,6 @@ impl EcdsaSignatureEncoding {
         }
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeyTemplate {
     /// Required. The type_url of the key type in format
@@ -543,7 +505,6 @@ pub struct KeyTemplate {
 /// to this serialized proto contains also type_url identifying the
 /// definition of *Key-proto (as in KeyFormat-message), and some extra metadata
 /// about the type key material.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeyData {
     /// Required.
@@ -590,11 +551,11 @@ pub mod key_data {
         /// (if the ProtoBuf definition does not change) and safe for programmatic use.
         pub fn as_str_name(&self) -> &'static str {
             match self {
-                KeyMaterialType::UnknownKeymaterial => "UNKNOWN_KEYMATERIAL",
-                KeyMaterialType::Symmetric => "SYMMETRIC",
-                KeyMaterialType::AsymmetricPrivate => "ASYMMETRIC_PRIVATE",
-                KeyMaterialType::AsymmetricPublic => "ASYMMETRIC_PUBLIC",
-                KeyMaterialType::Remote => "REMOTE",
+                Self::UnknownKeymaterial => "UNKNOWN_KEYMATERIAL",
+                Self::Symmetric => "SYMMETRIC",
+                Self::AsymmetricPrivate => "ASYMMETRIC_PRIVATE",
+                Self::AsymmetricPublic => "ASYMMETRIC_PUBLIC",
+                Self::Remote => "REMOTE",
             }
         }
         /// Creates an enum from field names used in the ProtoBuf definition.
@@ -614,7 +575,6 @@ pub mod key_data {
 /// to enable key rotation.  The keys in a keyset can belong to different
 /// implementations/key types, but must all implement the same primitive.
 /// Any given keyset (and any given key) can be used for one primitive only.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Keyset {
     /// Identifies key used to generate new crypto data (encrypt, sign).
@@ -628,7 +588,6 @@ pub struct Keyset {
 }
 /// Nested message and enum types in `Keyset`.
 pub mod keyset {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct Key {
         /// Contains the actual, instantiation specific key proto.
@@ -650,7 +609,6 @@ pub mod keyset {
 /// Represents a "safe" Keyset that doesn't contain any actual key material,
 /// thus can be used for logging or monitoring. Most fields are copied from
 /// Keyset.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetInfo {
     /// See Keyset.primary_key_id.
@@ -663,7 +621,6 @@ pub struct KeysetInfo {
 }
 /// Nested message and enum types in `KeysetInfo`.
 pub mod keyset_info {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct KeyInfo {
         /// the type url of this key,
@@ -682,7 +639,6 @@ pub mod keyset_info {
     }
 }
 /// Represents a keyset that is encrypted with a master key.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EncryptedKeyset {
     /// Required.
@@ -710,10 +666,10 @@ impl KeyStatusType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            KeyStatusType::UnknownStatus => "UNKNOWN_STATUS",
-            KeyStatusType::Enabled => "ENABLED",
-            KeyStatusType::Disabled => "DISABLED",
-            KeyStatusType::Destroyed => "DESTROYED",
+            Self::UnknownStatus => "UNKNOWN_STATUS",
+            Self::Enabled => "ENABLED",
+            Self::Disabled => "DISABLED",
+            Self::Destroyed => "DESTROYED",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -757,11 +713,11 @@ impl OutputPrefixType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            OutputPrefixType::UnknownPrefix => "UNKNOWN_PREFIX",
-            OutputPrefixType::Tink => "TINK",
-            OutputPrefixType::Legacy => "LEGACY",
-            OutputPrefixType::Raw => "RAW",
-            OutputPrefixType::Crunchy => "CRUNCHY",
+            Self::UnknownPrefix => "UNKNOWN_PREFIX",
+            Self::Tink => "TINK",
+            Self::Legacy => "LEGACY",
+            Self::Raw => "RAW",
+            Self::Crunchy => "CRUNCHY",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -777,7 +733,6 @@ impl OutputPrefixType {
     }
 }
 /// Parameters of KEM (Key Encapsulation Mechanism)
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesHkdfKemParams {
     /// Required.
@@ -791,7 +746,6 @@ pub struct EciesHkdfKemParams {
     pub hkdf_salt: ::prost::alloc::vec::Vec<u8>,
 }
 /// Parameters of AEAD DEM (Data Encapsulation Mechanism).
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadDemParams {
     /// Required.
@@ -800,7 +754,6 @@ pub struct EciesAeadDemParams {
     #[prost(message, optional, tag = "2")]
     pub aead_dem: ::core::option::Option<KeyTemplate>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfParams {
     /// Key Encapsulation Mechanism.
@@ -818,7 +771,6 @@ pub struct EciesAeadHkdfParams {
 }
 /// EciesAeadHkdfPublicKey represents HybridEncryption primitive.
 /// key_type: type.googleapis.com/google.crypto.tink.EciesAeadHkdfPublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfPublicKey {
     /// Required.
@@ -838,7 +790,6 @@ pub struct EciesAeadHkdfPublicKey {
 }
 /// EciesKdfAeadPrivateKey represents HybridDecryption primitive.
 /// key_type: type.googleapis.com/google.crypto.tink.EciesAeadHkdfPrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfPrivateKey {
     /// Required.
@@ -853,21 +804,18 @@ pub struct EciesAeadHkdfPrivateKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfKeyFormat {
     /// Required.
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<EciesAeadHkdfParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Ed25519KeyFormat {
     #[prost(uint32, tag = "1")]
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.Ed25519PublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Ed25519PublicKey {
     /// Required.
@@ -880,7 +828,6 @@ pub struct Ed25519PublicKey {
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.Ed25519PrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Ed25519PrivateKey {
     /// Required.
@@ -895,10 +842,8 @@ pub struct Ed25519PrivateKey {
     #[prost(message, optional, tag = "3")]
     pub public_key: ::core::option::Option<Ed25519PublicKey>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Empty {}
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HkdfPrfParams {
     #[prost(enumeration = "HashType", tag = "1")]
@@ -908,7 +853,6 @@ pub struct HkdfPrfParams {
     #[prost(bytes = "vec", tag = "2")]
     pub salt: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HkdfPrfKey {
     #[prost(uint32, tag = "1")]
@@ -918,7 +862,6 @@ pub struct HkdfPrfKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HkdfPrfKeyFormat {
     #[prost(message, optional, tag = "1")]
@@ -928,15 +871,13 @@ pub struct HkdfPrfKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacPrfParams {
     /// HashType is an enum.
     #[prost(enumeration = "HashType", tag = "1")]
     pub hash: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.HmacPrfKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HmacPrfKey {
     #[prost(uint32, tag = "1")]
@@ -946,8 +887,7 @@ pub struct HmacPrfKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacPrfKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<HmacPrfParams>,
@@ -957,7 +897,6 @@ pub struct HmacPrfKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.JwtHmacKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtHmacKey {
     #[prost(uint32, tag = "1")]
@@ -973,15 +912,13 @@ pub struct JwtHmacKey {
 pub mod jwt_hmac_key {
     /// Optional, custom kid header value to be used with "RAW" keys.
     /// "TINK" keys with this value set will be rejected.
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct CustomKid {
         #[prost(string, tag = "1")]
         pub value: ::prost::alloc::string::String,
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct JwtHmacKeyFormat {
     #[prost(uint32, tag = "1")]
     pub version: u32,
@@ -1005,10 +942,10 @@ impl JwtHmacAlgorithm {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            JwtHmacAlgorithm::HsUnknown => "HS_UNKNOWN",
-            JwtHmacAlgorithm::Hs256 => "HS256",
-            JwtHmacAlgorithm::Hs384 => "HS384",
-            JwtHmacAlgorithm::Hs512 => "HS512",
+            Self::HsUnknown => "HS_UNKNOWN",
+            Self::Hs256 => "HS256",
+            Self::Hs384 => "HS384",
+            Self::Hs512 => "HS512",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -1022,7 +959,6 @@ impl JwtHmacAlgorithm {
         }
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsAeadKeyFormat {
     /// Required.
@@ -1035,7 +971,6 @@ pub struct KmsAeadKeyFormat {
     pub key_uri: ::prost::alloc::string::String,
 }
 /// There is no actual key material in the key.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsAeadKey {
     #[prost(uint32, tag = "1")]
@@ -1044,7 +979,6 @@ pub struct KmsAeadKey {
     #[prost(message, optional, tag = "2")]
     pub params: ::core::option::Option<KmsAeadKeyFormat>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsEnvelopeAeadKeyFormat {
     /// Required.
@@ -1061,7 +995,6 @@ pub struct KmsEnvelopeAeadKeyFormat {
     pub dek_template: ::core::option::Option<KeyTemplate>,
 }
 /// There is no actual key material in the key.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsEnvelopeAeadKey {
     #[prost(uint32, tag = "1")]
@@ -1070,13 +1003,11 @@ pub struct KmsEnvelopeAeadKey {
     #[prost(message, optional, tag = "2")]
     pub params: ::core::option::Option<KmsEnvelopeAeadKeyFormat>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfBasedDeriverParams {
     #[prost(message, optional, tag = "1")]
     pub derived_key_template: ::core::option::Option<KeyTemplate>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfBasedDeriverKeyFormat {
     #[prost(message, optional, tag = "1")]
@@ -1085,7 +1016,6 @@ pub struct PrfBasedDeriverKeyFormat {
     pub params: ::core::option::Option<PrfBasedDeriverParams>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.PrfBasedDeriverKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfBasedDeriverKey {
     #[prost(uint32, tag = "1")]
@@ -1095,8 +1025,7 @@ pub struct PrfBasedDeriverKey {
     #[prost(message, optional, tag = "3")]
     pub params: ::core::option::Option<PrfBasedDeriverParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1Params {
     /// Hash function used in computing hash of the signing message
     /// (see <https://tools.ietf.org/html/rfc8017#section-9.2>).
@@ -1105,7 +1034,6 @@ pub struct RsaSsaPkcs1Params {
     pub hash_type: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPkcs1PublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1PublicKey {
     /// Required.
@@ -1124,7 +1052,6 @@ pub struct RsaSsaPkcs1PublicKey {
     pub e: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPkcs1PrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1PrivateKey {
     /// Required.
@@ -1165,7 +1092,6 @@ pub struct RsaSsaPkcs1PrivateKey {
     #[prost(bytes = "vec", tag = "8")]
     pub crt: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1KeyFormat {
     /// Required.
@@ -1178,8 +1104,7 @@ pub struct RsaSsaPkcs1KeyFormat {
     #[prost(bytes = "vec", tag = "3")]
     pub public_exponent: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssParams {
     /// Hash function used in computing hash of the signing message
     /// (see <https://tools.ietf.org/html/rfc8017#section-9.1.1>).
@@ -1197,7 +1122,6 @@ pub struct RsaSsaPssParams {
     pub salt_length: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPssPublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssPublicKey {
     /// Required.
@@ -1216,7 +1140,6 @@ pub struct RsaSsaPssPublicKey {
     pub e: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPssPrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssPrivateKey {
     /// Required.
@@ -1257,7 +1180,6 @@ pub struct RsaSsaPssPrivateKey {
     #[prost(bytes = "vec", tag = "8")]
     pub crt: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssKeyFormat {
     /// Required.
@@ -1270,14 +1192,12 @@ pub struct RsaSsaPssKeyFormat {
     #[prost(bytes = "vec", tag = "3")]
     pub public_exponent: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct XChaCha20Poly1305KeyFormat {
     #[prost(uint32, tag = "1")]
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.XChaCha20Poly1305Key
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct XChaCha20Poly1305Key {
     #[prost(uint32, tag = "1")]
diff --git a/proto/src/codegen/serde/google.crypto.tink.rs b/proto/src/codegen/serde/google.crypto.tink.rs
index bffce5fad..94048f07a 100644
--- a/proto/src/codegen/serde/google.crypto.tink.rs
+++ b/proto/src/codegen/serde/google.crypto.tink.rs
@@ -1,11 +1,10 @@
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+// This file is @generated by prost-build.
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCmacParams {
     #[prost(uint32, tag = "1")]
     pub tag_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCmacKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCmacKey {
     #[prost(uint32, tag = "1")]
@@ -15,8 +14,7 @@ pub struct AesCmacKey {
     #[prost(message, optional, tag = "3")]
     pub params: ::core::option::Option<AesCmacParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCmacKeyFormat {
     #[prost(uint32, tag = "1")]
     pub key_size: u32,
@@ -24,7 +22,6 @@ pub struct AesCmacKeyFormat {
     pub params: ::core::option::Option<AesCmacParams>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCmacPrfKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCmacPrfKey {
     #[prost(uint32, tag = "1")]
@@ -32,22 +29,19 @@ pub struct AesCmacPrfKey {
     #[prost(bytes = "vec", tag = "2")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCmacPrfKeyFormat {
     #[prost(uint32, tag = "2")]
     pub version: u32,
     #[prost(uint32, tag = "1")]
     pub key_size: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrParams {
     #[prost(uint32, tag = "1")]
     pub iv_size: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<AesCtrParams>,
@@ -55,7 +49,6 @@ pub struct AesCtrKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCtrKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCtrKey {
     #[prost(uint32, tag = "1")]
@@ -81,11 +74,11 @@ impl EllipticCurveType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            EllipticCurveType::UnknownCurve => "UNKNOWN_CURVE",
-            EllipticCurveType::NistP256 => "NIST_P256",
-            EllipticCurveType::NistP384 => "NIST_P384",
-            EllipticCurveType::NistP521 => "NIST_P521",
-            EllipticCurveType::Curve25519 => "CURVE25519",
+            Self::UnknownCurve => "UNKNOWN_CURVE",
+            Self::NistP256 => "NIST_P256",
+            Self::NistP384 => "NIST_P384",
+            Self::NistP521 => "NIST_P521",
+            Self::Curve25519 => "CURVE25519",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -117,12 +110,10 @@ impl EcPointFormat {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            EcPointFormat::UnknownFormat => "UNKNOWN_FORMAT",
-            EcPointFormat::Uncompressed => "UNCOMPRESSED",
-            EcPointFormat::Compressed => "COMPRESSED",
-            EcPointFormat::DoNotUseCrunchyUncompressed => {
-                "DO_NOT_USE_CRUNCHY_UNCOMPRESSED"
-            }
+            Self::UnknownFormat => "UNKNOWN_FORMAT",
+            Self::Uncompressed => "UNCOMPRESSED",
+            Self::Compressed => "COMPRESSED",
+            Self::DoNotUseCrunchyUncompressed => "DO_NOT_USE_CRUNCHY_UNCOMPRESSED",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -155,12 +146,12 @@ impl HashType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            HashType::UnknownHash => "UNKNOWN_HASH",
-            HashType::Sha1 => "SHA1",
-            HashType::Sha384 => "SHA384",
-            HashType::Sha256 => "SHA256",
-            HashType::Sha512 => "SHA512",
-            HashType::Sha224 => "SHA224",
+            Self::UnknownHash => "UNKNOWN_HASH",
+            Self::Sha1 => "SHA1",
+            Self::Sha384 => "SHA384",
+            Self::Sha256 => "SHA256",
+            Self::Sha512 => "SHA512",
+            Self::Sha224 => "SHA224",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -176,8 +167,7 @@ impl HashType {
         }
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacParams {
     /// HashType is an enum.
     #[prost(enumeration = "HashType", tag = "1")]
@@ -186,7 +176,6 @@ pub struct HmacParams {
     pub tag_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.HmacKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HmacKey {
     #[prost(uint32, tag = "1")]
@@ -196,8 +185,7 @@ pub struct HmacKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<HmacParams>,
@@ -206,8 +194,7 @@ pub struct HmacKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacAeadKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub aes_ctr_key_format: ::core::option::Option<AesCtrKeyFormat>,
@@ -215,7 +202,6 @@ pub struct AesCtrHmacAeadKeyFormat {
     pub hmac_key_format: ::core::option::Option<HmacKeyFormat>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCtrHmacAeadKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacAeadKey {
     #[prost(uint32, tag = "1")]
@@ -225,8 +211,7 @@ pub struct AesCtrHmacAeadKey {
     #[prost(message, optional, tag = "3")]
     pub hmac_key: ::core::option::Option<HmacKey>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacStreamingParams {
     #[prost(uint32, tag = "1")]
     pub ciphertext_segment_size: u32,
@@ -240,8 +225,7 @@ pub struct AesCtrHmacStreamingParams {
     #[prost(message, optional, tag = "4")]
     pub hmac_params: ::core::option::Option<HmacParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacStreamingKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
@@ -252,7 +236,6 @@ pub struct AesCtrHmacStreamingKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesCtrHmacStreamingKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesCtrHmacStreamingKey {
     #[prost(uint32, tag = "1")]
@@ -264,15 +247,13 @@ pub struct AesCtrHmacStreamingKey {
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
 /// only allowing tag size in bytes = 16
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesEaxParams {
     /// possible value is 12 or 16 bytes.
     #[prost(uint32, tag = "1")]
     pub iv_size: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesEaxKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<AesEaxParams>,
@@ -280,7 +261,6 @@ pub struct AesEaxKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesEaxKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesEaxKey {
     #[prost(uint32, tag = "1")]
@@ -292,8 +272,7 @@ pub struct AesEaxKey {
 }
 /// only allowing IV size in bytes = 12 and tag size in bytes = 16
 /// Thus, accept no params.
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmKeyFormat {
     #[prost(uint32, tag = "2")]
     pub key_size: u32,
@@ -301,7 +280,6 @@ pub struct AesGcmKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesGcmKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesGcmKey {
     #[prost(uint32, tag = "1")]
@@ -309,8 +287,7 @@ pub struct AesGcmKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmHkdfStreamingParams {
     #[prost(uint32, tag = "1")]
     pub ciphertext_segment_size: u32,
@@ -320,8 +297,7 @@ pub struct AesGcmHkdfStreamingParams {
     #[prost(enumeration = "HashType", tag = "3")]
     pub hkdf_hash_type: i32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmHkdfStreamingKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
@@ -332,7 +308,6 @@ pub struct AesGcmHkdfStreamingKeyFormat {
     pub key_size: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesGcmHkdfStreamingKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesGcmHkdfStreamingKey {
     #[prost(uint32, tag = "1")]
@@ -344,8 +319,7 @@ pub struct AesGcmHkdfStreamingKey {
 }
 /// The only allowed IV size is 12 bytes and tag size is 16 bytes.
 /// Thus, accept no params.
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesGcmSivKeyFormat {
     #[prost(uint32, tag = "2")]
     pub key_size: u32,
@@ -353,7 +327,6 @@ pub struct AesGcmSivKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesGcmSivKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesGcmSivKey {
     #[prost(uint32, tag = "1")]
@@ -361,8 +334,7 @@ pub struct AesGcmSivKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct AesSivKeyFormat {
     /// Only valid value is: 64.
     #[prost(uint32, tag = "1")]
@@ -371,7 +343,6 @@ pub struct AesSivKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.AesSivKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AesSivKey {
     #[prost(uint32, tag = "1")]
@@ -380,13 +351,11 @@ pub struct AesSivKey {
     #[prost(bytes = "vec", tag = "2")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct ChaCha20Poly1305KeyFormat {}
 /// key_type: type.googleapis.com/google.crypto.tink.ChaCha20Poly1305.
 /// This key type actually implements ChaCha20Poly1305 as described
 /// at <https://tools.ietf.org/html/rfc7539#section-2.8.>
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct ChaCha20Poly1305Key {
     #[prost(uint32, tag = "1")]
@@ -397,7 +366,6 @@ pub struct ChaCha20Poly1305Key {
 /// An entry that describes a key type to be used with Tink library,
 /// specifying the corresponding primitive, key manager, and deprecation status.
 /// All fields are required.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeyTypeEntry {
     /// E.g. “Aead”, “Mac”, ... (case-insensitive)
@@ -419,7 +387,6 @@ pub struct KeyTypeEntry {
 /// A complete configuration of Tink library: a list of key types
 /// to be available via the Registry after initialization.
 /// All fields are required.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RegistryConfig {
     #[prost(string, tag = "1")]
@@ -428,8 +395,7 @@ pub struct RegistryConfig {
     pub entry: ::prost::alloc::vec::Vec<KeyTypeEntry>,
 }
 /// Protos for Ecdsa.
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct EcdsaParams {
     /// Required.
     #[prost(enumeration = "HashType", tag = "1")]
@@ -442,7 +408,6 @@ pub struct EcdsaParams {
     pub encoding: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.EcdsaPublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EcdsaPublicKey {
     /// Required.
@@ -463,7 +428,6 @@ pub struct EcdsaPublicKey {
     pub y: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.EcdsaPrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EcdsaPrivateKey {
     /// Required.
@@ -477,8 +441,7 @@ pub struct EcdsaPrivateKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct EcdsaKeyFormat {
     /// Required.
     #[prost(message, optional, tag = "2")]
@@ -507,9 +470,9 @@ impl EcdsaSignatureEncoding {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            EcdsaSignatureEncoding::UnknownEncoding => "UNKNOWN_ENCODING",
-            EcdsaSignatureEncoding::IeeeP1363 => "IEEE_P1363",
-            EcdsaSignatureEncoding::Der => "DER",
+            Self::UnknownEncoding => "UNKNOWN_ENCODING",
+            Self::IeeeP1363 => "IEEE_P1363",
+            Self::Der => "DER",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -522,7 +485,6 @@ impl EcdsaSignatureEncoding {
         }
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeyTemplate {
     /// Required. The type_url of the key type in format
@@ -545,7 +507,6 @@ pub struct KeyTemplate {
 /// about the type key material.
 #[derive(serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeyData {
     /// Required.
@@ -594,11 +555,11 @@ pub mod key_data {
         /// (if the ProtoBuf definition does not change) and safe for programmatic use.
         pub fn as_str_name(&self) -> &'static str {
             match self {
-                KeyMaterialType::UnknownKeymaterial => "UNKNOWN_KEYMATERIAL",
-                KeyMaterialType::Symmetric => "SYMMETRIC",
-                KeyMaterialType::AsymmetricPrivate => "ASYMMETRIC_PRIVATE",
-                KeyMaterialType::AsymmetricPublic => "ASYMMETRIC_PUBLIC",
-                KeyMaterialType::Remote => "REMOTE",
+                Self::UnknownKeymaterial => "UNKNOWN_KEYMATERIAL",
+                Self::Symmetric => "SYMMETRIC",
+                Self::AsymmetricPrivate => "ASYMMETRIC_PRIVATE",
+                Self::AsymmetricPublic => "ASYMMETRIC_PUBLIC",
+                Self::Remote => "REMOTE",
             }
         }
         /// Creates an enum from field names used in the ProtoBuf definition.
@@ -620,7 +581,6 @@ pub mod key_data {
 /// Any given keyset (and any given key) can be used for one primitive only.
 #[derive(serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Keyset {
     /// Identifies key used to generate new crypto data (encrypt, sign).
@@ -636,7 +596,6 @@ pub struct Keyset {
 pub mod keyset {
     #[derive(serde::Serialize, serde::Deserialize)]
     #[serde(rename_all = "camelCase")]
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct Key {
         /// Contains the actual, instantiation specific key proto.
@@ -662,7 +621,6 @@ pub mod keyset {
 /// Keyset.
 #[derive(serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetInfo {
     /// See Keyset.primary_key_id.
@@ -677,7 +635,6 @@ pub struct KeysetInfo {
 pub mod keyset_info {
     #[derive(serde::Serialize, serde::Deserialize)]
     #[serde(rename_all = "camelCase")]
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct KeyInfo {
         /// the type url of this key,
@@ -700,7 +657,6 @@ pub mod keyset_info {
 /// Represents a keyset that is encrypted with a master key.
 #[derive(serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EncryptedKeyset {
     /// Required.
@@ -729,10 +685,10 @@ impl KeyStatusType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            KeyStatusType::UnknownStatus => "UNKNOWN_STATUS",
-            KeyStatusType::Enabled => "ENABLED",
-            KeyStatusType::Disabled => "DISABLED",
-            KeyStatusType::Destroyed => "DESTROYED",
+            Self::UnknownStatus => "UNKNOWN_STATUS",
+            Self::Enabled => "ENABLED",
+            Self::Disabled => "DISABLED",
+            Self::Destroyed => "DESTROYED",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -776,11 +732,11 @@ impl OutputPrefixType {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            OutputPrefixType::UnknownPrefix => "UNKNOWN_PREFIX",
-            OutputPrefixType::Tink => "TINK",
-            OutputPrefixType::Legacy => "LEGACY",
-            OutputPrefixType::Raw => "RAW",
-            OutputPrefixType::Crunchy => "CRUNCHY",
+            Self::UnknownPrefix => "UNKNOWN_PREFIX",
+            Self::Tink => "TINK",
+            Self::Legacy => "LEGACY",
+            Self::Raw => "RAW",
+            Self::Crunchy => "CRUNCHY",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -796,7 +752,6 @@ impl OutputPrefixType {
     }
 }
 /// Parameters of KEM (Key Encapsulation Mechanism)
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesHkdfKemParams {
     /// Required.
@@ -810,7 +765,6 @@ pub struct EciesHkdfKemParams {
     pub hkdf_salt: ::prost::alloc::vec::Vec<u8>,
 }
 /// Parameters of AEAD DEM (Data Encapsulation Mechanism).
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadDemParams {
     /// Required.
@@ -819,7 +773,6 @@ pub struct EciesAeadDemParams {
     #[prost(message, optional, tag = "2")]
     pub aead_dem: ::core::option::Option<KeyTemplate>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfParams {
     /// Key Encapsulation Mechanism.
@@ -837,7 +790,6 @@ pub struct EciesAeadHkdfParams {
 }
 /// EciesAeadHkdfPublicKey represents HybridEncryption primitive.
 /// key_type: type.googleapis.com/google.crypto.tink.EciesAeadHkdfPublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfPublicKey {
     /// Required.
@@ -857,7 +809,6 @@ pub struct EciesAeadHkdfPublicKey {
 }
 /// EciesKdfAeadPrivateKey represents HybridDecryption primitive.
 /// key_type: type.googleapis.com/google.crypto.tink.EciesAeadHkdfPrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfPrivateKey {
     /// Required.
@@ -872,21 +823,18 @@ pub struct EciesAeadHkdfPrivateKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct EciesAeadHkdfKeyFormat {
     /// Required.
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<EciesAeadHkdfParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Ed25519KeyFormat {
     #[prost(uint32, tag = "1")]
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.Ed25519PublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Ed25519PublicKey {
     /// Required.
@@ -899,7 +847,6 @@ pub struct Ed25519PublicKey {
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.Ed25519PrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Ed25519PrivateKey {
     /// Required.
@@ -914,10 +861,8 @@ pub struct Ed25519PrivateKey {
     #[prost(message, optional, tag = "3")]
     pub public_key: ::core::option::Option<Ed25519PublicKey>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Empty {}
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HkdfPrfParams {
     #[prost(enumeration = "HashType", tag = "1")]
@@ -927,7 +872,6 @@ pub struct HkdfPrfParams {
     #[prost(bytes = "vec", tag = "2")]
     pub salt: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HkdfPrfKey {
     #[prost(uint32, tag = "1")]
@@ -937,7 +881,6 @@ pub struct HkdfPrfKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HkdfPrfKeyFormat {
     #[prost(message, optional, tag = "1")]
@@ -947,15 +890,13 @@ pub struct HkdfPrfKeyFormat {
     #[prost(uint32, tag = "3")]
     pub version: u32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacPrfParams {
     /// HashType is an enum.
     #[prost(enumeration = "HashType", tag = "1")]
     pub hash: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.HmacPrfKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HmacPrfKey {
     #[prost(uint32, tag = "1")]
@@ -965,8 +906,7 @@ pub struct HmacPrfKey {
     #[prost(bytes = "vec", tag = "3")]
     pub key_value: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct HmacPrfKeyFormat {
     #[prost(message, optional, tag = "1")]
     pub params: ::core::option::Option<HmacPrfParams>,
@@ -976,7 +916,6 @@ pub struct HmacPrfKeyFormat {
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.JwtHmacKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtHmacKey {
     #[prost(uint32, tag = "1")]
@@ -992,15 +931,13 @@ pub struct JwtHmacKey {
 pub mod jwt_hmac_key {
     /// Optional, custom kid header value to be used with "RAW" keys.
     /// "TINK" keys with this value set will be rejected.
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct CustomKid {
         #[prost(string, tag = "1")]
         pub value: ::prost::alloc::string::String,
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct JwtHmacKeyFormat {
     #[prost(uint32, tag = "1")]
     pub version: u32,
@@ -1024,10 +961,10 @@ impl JwtHmacAlgorithm {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            JwtHmacAlgorithm::HsUnknown => "HS_UNKNOWN",
-            JwtHmacAlgorithm::Hs256 => "HS256",
-            JwtHmacAlgorithm::Hs384 => "HS384",
-            JwtHmacAlgorithm::Hs512 => "HS512",
+            Self::HsUnknown => "HS_UNKNOWN",
+            Self::Hs256 => "HS256",
+            Self::Hs384 => "HS384",
+            Self::Hs512 => "HS512",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -1041,7 +978,6 @@ impl JwtHmacAlgorithm {
         }
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsAeadKeyFormat {
     /// Required.
@@ -1054,7 +990,6 @@ pub struct KmsAeadKeyFormat {
     pub key_uri: ::prost::alloc::string::String,
 }
 /// There is no actual key material in the key.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsAeadKey {
     #[prost(uint32, tag = "1")]
@@ -1063,7 +998,6 @@ pub struct KmsAeadKey {
     #[prost(message, optional, tag = "2")]
     pub params: ::core::option::Option<KmsAeadKeyFormat>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsEnvelopeAeadKeyFormat {
     /// Required.
@@ -1080,7 +1014,6 @@ pub struct KmsEnvelopeAeadKeyFormat {
     pub dek_template: ::core::option::Option<KeyTemplate>,
 }
 /// There is no actual key material in the key.
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KmsEnvelopeAeadKey {
     #[prost(uint32, tag = "1")]
@@ -1089,13 +1022,11 @@ pub struct KmsEnvelopeAeadKey {
     #[prost(message, optional, tag = "2")]
     pub params: ::core::option::Option<KmsEnvelopeAeadKeyFormat>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfBasedDeriverParams {
     #[prost(message, optional, tag = "1")]
     pub derived_key_template: ::core::option::Option<KeyTemplate>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfBasedDeriverKeyFormat {
     #[prost(message, optional, tag = "1")]
@@ -1104,7 +1035,6 @@ pub struct PrfBasedDeriverKeyFormat {
     pub params: ::core::option::Option<PrfBasedDeriverParams>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.PrfBasedDeriverKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfBasedDeriverKey {
     #[prost(uint32, tag = "1")]
@@ -1114,8 +1044,7 @@ pub struct PrfBasedDeriverKey {
     #[prost(message, optional, tag = "3")]
     pub params: ::core::option::Option<PrfBasedDeriverParams>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1Params {
     /// Hash function used in computing hash of the signing message
     /// (see <https://tools.ietf.org/html/rfc8017#section-9.2>).
@@ -1124,7 +1053,6 @@ pub struct RsaSsaPkcs1Params {
     pub hash_type: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPkcs1PublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1PublicKey {
     /// Required.
@@ -1143,7 +1071,6 @@ pub struct RsaSsaPkcs1PublicKey {
     pub e: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPkcs1PrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1PrivateKey {
     /// Required.
@@ -1184,7 +1111,6 @@ pub struct RsaSsaPkcs1PrivateKey {
     #[prost(bytes = "vec", tag = "8")]
     pub crt: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPkcs1KeyFormat {
     /// Required.
@@ -1197,8 +1123,7 @@ pub struct RsaSsaPkcs1KeyFormat {
     #[prost(bytes = "vec", tag = "3")]
     pub public_exponent: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssParams {
     /// Hash function used in computing hash of the signing message
     /// (see <https://tools.ietf.org/html/rfc8017#section-9.1.1>).
@@ -1216,7 +1141,6 @@ pub struct RsaSsaPssParams {
     pub salt_length: i32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPssPublicKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssPublicKey {
     /// Required.
@@ -1235,7 +1159,6 @@ pub struct RsaSsaPssPublicKey {
     pub e: ::prost::alloc::vec::Vec<u8>,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.RsaSsaPssPrivateKey
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssPrivateKey {
     /// Required.
@@ -1276,7 +1199,6 @@ pub struct RsaSsaPssPrivateKey {
     #[prost(bytes = "vec", tag = "8")]
     pub crt: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RsaSsaPssKeyFormat {
     /// Required.
@@ -1289,14 +1211,12 @@ pub struct RsaSsaPssKeyFormat {
     #[prost(bytes = "vec", tag = "3")]
     pub public_exponent: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct XChaCha20Poly1305KeyFormat {
     #[prost(uint32, tag = "1")]
     pub version: u32,
 }
 /// key_type: type.googleapis.com/google.crypto.tink.XChaCha20Poly1305Key
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct XChaCha20Poly1305Key {
     #[prost(uint32, tag = "1")]
diff --git a/proto/src/lib.rs b/proto/src/lib.rs
index 0cfb74baa..5870b5fe0 100644
--- a/proto/src/lib.rs
+++ b/proto/src/lib.rs
@@ -40,14 +40,15 @@ pub mod json {
     pub mod key_status_type {
         //! Manual JSON serialization for [`KeyStatusType`](crate::KeyStatusType) enums.
         use serde::Deserialize;
+        use std::convert::TryFrom;
         pub fn serialize<S: serde::Serializer>(
             val: &i32,
             serializer: S,
         ) -> Result<S::Ok, S::Error> {
-            serializer.serialize_str(match crate::KeyStatusType::from_i32(*val) {
-                Some(crate::KeyStatusType::Enabled) => "ENABLED",
-                Some(crate::KeyStatusType::Disabled) => "DISABLED",
-                Some(crate::KeyStatusType::Destroyed) => "DESTROYED",
+            serializer.serialize_str(match crate::KeyStatusType::try_from(*val) {
+                Ok(crate::KeyStatusType::Enabled) => "ENABLED",
+                Ok(crate::KeyStatusType::Disabled) => "DISABLED",
+                Ok(crate::KeyStatusType::Destroyed) => "DESTROYED",
                 _ => "UNKNOWN",
             })
         }
@@ -66,15 +67,16 @@ pub mod json {
     pub mod output_prefix_type {
         //! Manual JSON serialization for [`OutputPrefixType`](crate::OutputPrefixType) enums.
         use serde::Deserialize;
+        use std::convert::TryFrom;
         pub fn serialize<S: serde::Serializer>(
             val: &i32,
             serializer: S,
         ) -> Result<S::Ok, S::Error> {
-            serializer.serialize_str(match crate::OutputPrefixType::from_i32(*val) {
-                Some(crate::OutputPrefixType::Tink) => "TINK",
-                Some(crate::OutputPrefixType::Legacy) => "LEGACY",
-                Some(crate::OutputPrefixType::Raw) => "RAW",
-                Some(crate::OutputPrefixType::Crunchy) => "CRUNCHY",
+            serializer.serialize_str(match crate::OutputPrefixType::try_from(*val) {
+                Ok(crate::OutputPrefixType::Tink) => "TINK",
+                Ok(crate::OutputPrefixType::Legacy) => "LEGACY",
+                Ok(crate::OutputPrefixType::Raw) => "RAW",
+                Ok(crate::OutputPrefixType::Crunchy) => "CRUNCHY",
                 _ => "UNKNOWN",
             })
         }
@@ -95,15 +97,16 @@ pub mod json {
         //! Manual JSON serialization for [`KeyMaterialType`](crate::key_data::KeyMaterialType)
         //! enums.
         use serde::Deserialize;
+        use std::convert::TryFrom;
         pub fn serialize<S: serde::Serializer>(
             val: &i32,
             serializer: S,
         ) -> Result<S::Ok, S::Error> {
-            serializer.serialize_str(match crate::key_data::KeyMaterialType::from_i32(*val) {
-                Some(crate::key_data::KeyMaterialType::Symmetric) => "SYMMETRIC",
-                Some(crate::key_data::KeyMaterialType::AsymmetricPrivate) => "ASYMMETRIC_PRIVATE",
-                Some(crate::key_data::KeyMaterialType::AsymmetricPublic) => "ASYMMETRIC_PUBLIC",
-                Some(crate::key_data::KeyMaterialType::Remote) => "REMOTE",
+            serializer.serialize_str(match crate::key_data::KeyMaterialType::try_from(*val) {
+                Ok(crate::key_data::KeyMaterialType::Symmetric) => "SYMMETRIC",
+                Ok(crate::key_data::KeyMaterialType::AsymmetricPrivate) => "ASYMMETRIC_PRIVATE",
+                Ok(crate::key_data::KeyMaterialType::AsymmetricPublic) => "ASYMMETRIC_PUBLIC",
+                Ok(crate::key_data::KeyMaterialType::Remote) => "REMOTE",
                 _ => "UNKNOWN",
             })
         }
diff --git a/rinkey/CHANGELOG.md b/rinkey/CHANGELOG.md
index d1621f257..34b1634db 100644
--- a/rinkey/CHANGELOG.md
+++ b/rinkey/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/rinkey/README.md b/rinkey/README.md
index 5f1ad25f5..1715b0bcc 100644
--- a/rinkey/README.md
+++ b/rinkey/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: `rinkey` Command-Line Key Management Tool
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://project-oak.github.io/tink-rust/rust/rinkey)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides the `rinkey` binary, which allows command-line manipulation of Tink keysets,
 equivalent to the upstream [`tinkey` utility](https://github.com/google/tink/blob/master/docs/TINKEY.md).
diff --git a/rinkey/src/main.rs b/rinkey/src/main.rs
index 3af9675c7..1c63dc2dd 100644
--- a/rinkey/src/main.rs
+++ b/rinkey/src/main.rs
@@ -18,6 +18,7 @@
 
 use std::{
     cell::RefCell,
+    convert::TryFrom,
     fs::{File, OpenOptions},
     path::PathBuf,
     rc::Rc,
@@ -378,21 +379,21 @@ fn list_keyset(opts: InOptions) {
         println!("  type_url: \"{}\"", key.type_url);
         println!(
             "  status: {}",
-            match KeyStatusType::from_i32(key.status) {
-                Some(KeyStatusType::Enabled) => "ENABLED",
-                Some(KeyStatusType::Disabled) => "DISABLED",
-                Some(KeyStatusType::Destroyed) => "DESTROYED",
+            match KeyStatusType::try_from(key.status) {
+                Ok(KeyStatusType::Enabled) => "ENABLED",
+                Ok(KeyStatusType::Disabled) => "DISABLED",
+                Ok(KeyStatusType::Destroyed) => "DESTROYED",
                 _ => "UNKNOWN",
             }
         );
         println!("  key_id: {}", key.key_id);
         println!(
             "  output_prefix_type: {}",
-            match OutputPrefixType::from_i32(key.output_prefix_type) {
-                Some(OutputPrefixType::Tink) => "TINK",
-                Some(OutputPrefixType::Legacy) => "LEGACY",
-                Some(OutputPrefixType::Raw) => "RAW",
-                Some(OutputPrefixType::Crunchy) => "CRUNCHY",
+            match OutputPrefixType::try_from(key.output_prefix_type) {
+                Ok(OutputPrefixType::Tink) => "TINK",
+                Ok(OutputPrefixType::Legacy) => "LEGACY",
+                Ok(OutputPrefixType::Raw) => "RAW",
+                Ok(OutputPrefixType::Crunchy) => "CRUNCHY",
                 _ => "UNKNOWN",
             }
         );
diff --git a/signature/CHANGELOG.md b/signature/CHANGELOG.md
index a7bbb3753..a7647fe15 100644
--- a/signature/CHANGELOG.md
+++ b/signature/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/signature/README.md b/signature/README.md
index f5596fbce..9ff96e754 100644
--- a/signature/README.md
+++ b/signature/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Digital Signatures
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-signature)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides digital signature functionality, as described in the upstream
 [Tink documentation](https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#digital-signatures).
diff --git a/signature/src/ecdsa_signer_key_manager.rs b/signature/src/ecdsa_signer_key_manager.rs
index 7df111371..c40711e81 100644
--- a/signature/src/ecdsa_signer_key_manager.rs
+++ b/signature/src/ecdsa_signer_key_manager.rs
@@ -172,5 +172,5 @@ fn validate_key_format(
         .ok_or_else(|| TinkError::new("no public key parameters"))?;
     let (hash, curve, encoding) = crate::get_ecdsa_param_ids(params);
     crate::subtle::validate_ecdsa_params(hash, curve, encoding)?;
-    Ok((params.clone(), curve))
+    Ok((*params, curve))
 }
diff --git a/signature/src/ecdsa_verifier_key_manager.rs b/signature/src/ecdsa_verifier_key_manager.rs
index ebaf948c7..f35182e85 100644
--- a/signature/src/ecdsa_verifier_key_manager.rs
+++ b/signature/src/ecdsa_verifier_key_manager.rs
@@ -71,5 +71,5 @@ pub(crate) fn validate_ecdsa_public_key(
         .ok_or_else(|| TinkError::new("no public key parameters"))?;
     let (hash, curve, encoding) = crate::get_ecdsa_param_ids(params);
     crate::subtle::validate_ecdsa_params(hash, curve, encoding)?;
-    Ok(params.clone())
+    Ok(*params)
 }
diff --git a/signature/src/proto.rs b/signature/src/proto.rs
index a6c4156de..e470be8e5 100644
--- a/signature/src/proto.rs
+++ b/signature/src/proto.rs
@@ -16,6 +16,7 @@
 
 //! Utilities for dealing with protobuf types for signing.
 
+use std::convert::TryFrom;
 use tink_proto::{EcdsaParams, EcdsaSignatureEncoding, EllipticCurveType, HashType};
 
 /// Return the enum values of each parameter in
@@ -24,9 +25,9 @@ pub(crate) fn get_ecdsa_param_ids(
     params: &EcdsaParams,
 ) -> (HashType, EllipticCurveType, EcdsaSignatureEncoding) {
     (
-        HashType::from_i32(params.hash_type).unwrap_or(HashType::UnknownHash),
-        EllipticCurveType::from_i32(params.curve).unwrap_or(EllipticCurveType::UnknownCurve),
-        EcdsaSignatureEncoding::from_i32(params.encoding)
+        HashType::try_from(params.hash_type).unwrap_or(HashType::UnknownHash),
+        EllipticCurveType::try_from(params.curve).unwrap_or(EllipticCurveType::UnknownCurve),
+        EcdsaSignatureEncoding::try_from(params.encoding)
             .unwrap_or(EcdsaSignatureEncoding::UnknownEncoding),
     )
 }
diff --git a/signature/src/signature_key_templates.rs b/signature/src/signature_key_templates.rs
index 7580725f3..4edd48b28 100644
--- a/signature/src/signature_key_templates.rs
+++ b/signature/src/signature_key_templates.rs
@@ -23,6 +23,7 @@ use tink_proto::{prost::Message, KeyTemplate};
 ///   - Curve: NIST P-256
 ///   - Signature encoding: DER
 ///   - Output prefix type: TINK
+///
 /// Note that this template uses a different encoding than ESDSA_P256_RAW in Tinkey / `rinkey`.
 pub fn ecdsa_p256_key_template() -> KeyTemplate {
     create_ecdsa_key_template(
diff --git a/streaming/CHANGELOG.md b/streaming/CHANGELOG.md
index ef0e4ec71..2a20af93c 100644
--- a/streaming/CHANGELOG.md
+++ b/streaming/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 0.2.6 - TBD
 
-- Increase MSRV to 1.65.0
+- Increase MSRV to 1.71.1
 - Upgrade dependencies
 
 ## 0.2.5 - 2023-03-14
diff --git a/streaming/README.md b/streaming/README.md
index 5adacdd40..a0aea686b 100644
--- a/streaming/README.md
+++ b/streaming/README.md
@@ -1,7 +1,7 @@
 # Tink-Rust: Streaming Authenticated Encryption with Additional Data
 
 [![Docs](https://img.shields.io/badge/docs-rust-brightgreen?style=for-the-badge)](https://docs.rs/tink-streaming-aead)
-![MSRV](https://img.shields.io/badge/rustc-1.65+-yellow?style=for-the-badge)
+![MSRV](https://img.shields.io/badge/rustc-1.71.1+-yellow?style=for-the-badge)
 
 This crate provides streaming authenticated encryption with additional data functionality, as described in the upstream
 [Tink documentation](https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#streaming-authenticated-encryption-with-associated-data).
diff --git a/streaming/src/aes_ctr_hmac_key_manager.rs b/streaming/src/aes_ctr_hmac_key_manager.rs
index 9f89e3d1f..108bb8133 100644
--- a/streaming/src/aes_ctr_hmac_key_manager.rs
+++ b/streaming/src/aes_ctr_hmac_key_manager.rs
@@ -16,6 +16,7 @@
 
 //! Key manager for streaming AES-CTR-HMAC keys.
 
+use std::convert::TryFrom;
 use tink_core::{subtle::random::get_random_bytes, utils::wrap_err, TinkError};
 use tink_proto::{prost::Message, HashType};
 
@@ -99,7 +100,7 @@ fn validate_key(
         .params
         .as_ref()
         .ok_or_else(|| TinkError::new("AesCtrHmacKeyManager: no params"))?;
-    Ok(key_params.clone())
+    Ok(*key_params)
 }
 
 /// Validate the given [`tink_proto::AesCtrHmacStreamingKeyFormat`].
@@ -113,7 +114,7 @@ fn validate_key_format(
         .as_ref()
         .ok_or_else(|| TinkError::new("AesCtrHmacKeyManager: no params"))?;
     validate_params(key_params)?;
-    Ok(key_params.clone())
+    Ok(*key_params)
 }
 
 /// Validate the given [`tink_proto::AesCtrHmacStreamingParams`].
@@ -121,21 +122,21 @@ fn validate_params(
     params: &tink_proto::AesCtrHmacStreamingParams,
 ) -> Result<(tink_proto::HmacParams, HashType, HashType), TinkError> {
     crate::subtle::validate_aes_key_size(params.derived_key_size as usize)?;
-    let hkdf_hash = match HashType::from_i32(params.hkdf_hash_type) {
-        Some(HashType::UnknownHash) => return Err("AesCtrHmacKeyManager: unknown HKDF hash".into()),
-        Some(h) => h,
-        None => return Err("AesCtrHmacKeyManager: unknown HKDF hash".into()),
+    let hkdf_hash = match HashType::try_from(params.hkdf_hash_type) {
+        Ok(HashType::UnknownHash) => return Err("AesCtrHmacKeyManager: unknown HKDF hash".into()),
+        Ok(h) => h,
+        Err(_) => return Err("AesCtrHmacKeyManager: unknown HKDF hash".into()),
     };
     let hmac_params = params
         .hmac_params
         .as_ref()
         .ok_or_else(|| TinkError::new("AesCtrHmacKeyManager: no HMAC params"))?;
-    let hmac_hash = match HashType::from_i32(hmac_params.hash) {
-        Some(HashType::UnknownHash) => {
+    let hmac_hash = match HashType::try_from(hmac_params.hash) {
+        Ok(HashType::UnknownHash) => {
             return Err("AesCtrHmacKeyManager: unknown tag algorithm".into())
         }
-        Some(h) => h,
-        None => return Err("AesCtrHmacKeyManager: unknown tag algorithm".into()),
+        Ok(h) => h,
+        Err(_) => return Err("AesCtrHmacKeyManager: unknown tag algorithm".into()),
     };
     tink_mac::subtle::validate_hmac_params(
         hmac_hash,
@@ -150,5 +151,5 @@ fn validate_params(
     if (params.ciphertext_segment_size as usize) < min_segment_size {
         return Err("AesCtrHmacKeyManager: ciphertext segment size must be at least (derived_key_size + nonce_prefix_in_bytes + tag_size_in_bytes + 2)".into());
     }
-    Ok((hmac_params.clone(), hkdf_hash, hmac_hash))
+    Ok((*hmac_params, hkdf_hash, hmac_hash))
 }
diff --git a/streaming/src/aes_gcm_hkdf_key_manager.rs b/streaming/src/aes_gcm_hkdf_key_manager.rs
index b95dd3906..89819dbfb 100644
--- a/streaming/src/aes_gcm_hkdf_key_manager.rs
+++ b/streaming/src/aes_gcm_hkdf_key_manager.rs
@@ -17,6 +17,7 @@
 //! Key manager for streaming AES-GCM-HKDF.
 
 use crate::subtle;
+use std::convert::TryFrom;
 use tink_core::{subtle::random::get_random_bytes, utils::wrap_err, TinkError};
 use tink_proto::{prost::Message, HashType};
 
@@ -97,7 +98,7 @@ fn validate_key(
         .as_ref()
         .ok_or_else(|| TinkError::new("no key params"))?;
     let hkdf_hash = validate_params(key_params)?;
-    Ok((key_params.clone(), hkdf_hash))
+    Ok((*key_params, hkdf_hash))
 }
 
 /// Validate the given [`tink_proto::AesGcmHkdfStreamingKeyFormat`].
@@ -110,16 +111,16 @@ fn validate_key_format(
         .as_ref()
         .ok_or_else(|| TinkError::new("no format params"))?;
     validate_params(format_params).map_err(|e| wrap_err("AesGcmHkdfKeyManager", e))?;
-    Ok(format_params.clone())
+    Ok(*format_params)
 }
 
 /// Validate the given [`tink_proto::AesGcmHkdfStreamingParams`].
 fn validate_params(params: &tink_proto::AesGcmHkdfStreamingParams) -> Result<HashType, TinkError> {
     crate::subtle::validate_aes_key_size(params.derived_key_size as usize)?;
-    let hkdf_hash = match HashType::from_i32(params.hkdf_hash_type) {
-        Some(HashType::UnknownHash) => return Err("unknown HKDF hash type".into()),
-        Some(h) => h,
-        None => return Err("unknown HKDF hash type".into()),
+    let hkdf_hash = match HashType::try_from(params.hkdf_hash_type) {
+        Ok(HashType::UnknownHash) => return Err("unknown HKDF hash type".into()),
+        Ok(h) => h,
+        Err(_) => return Err("unknown HKDF hash type".into()),
     };
     let min_segment_size = (params.derived_key_size as usize)
         + subtle::AES_GCM_HKDF_NONCE_PREFIX_SIZE_IN_BYTES
diff --git a/testing/Cargo.toml b/testing/Cargo.toml
index 684b90fa5..0e1770853 100644
--- a/testing/Cargo.toml
+++ b/testing/Cargo.toml
@@ -2,7 +2,7 @@
 name = "tink-testing-server"
 version = "0.2.5"
 authors = ["David Drysdale <drysdale@google.com>"]
-edition = "2018"
+edition = "2021"
 license = "Apache-2.0"
 description = "Testing server for Rust port of Google's Tink cryptography library"
 repository = "https://github.com/project-oak/tink-rust"
@@ -14,7 +14,7 @@ publish = false
 env_logger = "^0.10.1"
 futures = "^0.3.30"
 log = "^0.4.22"
-prost = "^0.11"
+prost = "^0.13"
 structopt = "^0.3.26"
 tink-aead = "^0.2"
 tink-core = { version = "^0.2", features = [
@@ -34,7 +34,7 @@ tokio = { version = "^1.16", features = [
   "rt-multi-thread",
   "signal",
 ] }
-tonic = "^0.9"
+tonic = "^0.12"
 
 [build-dependencies]
-tonic-build = "^0.8"
+tonic-build = "^0.12"
diff --git a/testing/build.rs b/testing/build.rs
index 415ee2781..936dfbf43 100644
--- a/testing/build.rs
+++ b/testing/build.rs
@@ -41,7 +41,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     // Emit generated code into the source directory, so it can be checked in.
     tonic_build::configure()
         .out_dir("src/codegen")
-        .compile(&proto_files, &[PathBuf::from(".")])?;
+        .compile_protos(&proto_files, &[PathBuf::from(".")])?;
 
     Ok(())
 }
diff --git a/testing/src/codegen/tink_testing_api.rs b/testing/src/codegen/tink_testing_api.rs
index 51fde05ea..dba592708 100644
--- a/testing/src/codegen/tink_testing_api.rs
+++ b/testing/src/codegen/tink_testing_api.rs
@@ -1,7 +1,6 @@
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+// This file is @generated by prost-build.
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct ServerInfoRequest {}
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct ServerInfoResponse {
     /// For example '1.4'
@@ -11,14 +10,12 @@ pub struct ServerInfoResponse {
     #[prost(string, tag = "2")]
     pub language: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetTemplateRequest {
     /// template name used by Tinkey
     #[prost(string, tag = "1")]
     pub template_name: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetTemplateResponse {
     #[prost(oneof = "keyset_template_response::Result", tags = "1, 2")]
@@ -26,7 +23,6 @@ pub struct KeysetTemplateResponse {
 }
 /// Nested message and enum types in `KeysetTemplateResponse`.
 pub mod keyset_template_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         /// serialized google.crypto.tink.KeyTemplate.
@@ -36,14 +32,12 @@ pub mod keyset_template_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetGenerateRequest {
     /// serialized google.crypto.tink.KeyTemplate.
     #[prost(bytes = "vec", tag = "1")]
     pub template: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetGenerateResponse {
     #[prost(oneof = "keyset_generate_response::Result", tags = "1, 2")]
@@ -51,7 +45,6 @@ pub struct KeysetGenerateResponse {
 }
 /// Nested message and enum types in `KeysetGenerateResponse`.
 pub mod keyset_generate_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         /// serialized google.crypto.tink.Keyset.
@@ -61,14 +54,12 @@ pub mod keyset_generate_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetPublicRequest {
     /// serialized google.crypto.tink.Keyset.
     #[prost(bytes = "vec", tag = "1")]
     pub private_keyset: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetPublicResponse {
     #[prost(oneof = "keyset_public_response::Result", tags = "1, 2")]
@@ -76,7 +67,6 @@ pub struct KeysetPublicResponse {
 }
 /// Nested message and enum types in `KeysetPublicResponse`.
 pub mod keyset_public_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         /// serialized google.crypto.tink.Keyset.
@@ -86,14 +76,12 @@ pub mod keyset_public_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetToJsonRequest {
     /// serialized google.crypto.tink.Keyset.
     #[prost(bytes = "vec", tag = "1")]
     pub keyset: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetToJsonResponse {
     #[prost(oneof = "keyset_to_json_response::Result", tags = "1, 2")]
@@ -101,7 +89,6 @@ pub struct KeysetToJsonResponse {
 }
 /// Nested message and enum types in `KeysetToJsonResponse`.
 pub mod keyset_to_json_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(string, tag = "1")]
@@ -110,13 +97,11 @@ pub mod keyset_to_json_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetFromJsonRequest {
     #[prost(string, tag = "1")]
     pub json_keyset: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct KeysetFromJsonResponse {
     #[prost(oneof = "keyset_from_json_response::Result", tags = "1, 2")]
@@ -124,7 +109,6 @@ pub struct KeysetFromJsonResponse {
 }
 /// Nested message and enum types in `KeysetFromJsonResponse`.
 pub mod keyset_from_json_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         /// serialized google.crypto.tink.Keyset.
@@ -134,7 +118,6 @@ pub mod keyset_from_json_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AeadEncryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -145,7 +128,6 @@ pub struct AeadEncryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub associated_data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AeadEncryptResponse {
     #[prost(oneof = "aead_encrypt_response::Result", tags = "1, 2")]
@@ -153,7 +135,6 @@ pub struct AeadEncryptResponse {
 }
 /// Nested message and enum types in `AeadEncryptResponse`.
 pub mod aead_encrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -162,7 +143,6 @@ pub mod aead_encrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AeadDecryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -173,7 +153,6 @@ pub struct AeadDecryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub associated_data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct AeadDecryptResponse {
     #[prost(oneof = "aead_decrypt_response::Result", tags = "1, 2")]
@@ -181,7 +160,6 @@ pub struct AeadDecryptResponse {
 }
 /// Nested message and enum types in `AeadDecryptResponse`.
 pub mod aead_decrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -190,7 +168,6 @@ pub mod aead_decrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct DeterministicAeadEncryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -201,7 +178,6 @@ pub struct DeterministicAeadEncryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub associated_data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct DeterministicAeadEncryptResponse {
     #[prost(oneof = "deterministic_aead_encrypt_response::Result", tags = "1, 2")]
@@ -209,7 +185,6 @@ pub struct DeterministicAeadEncryptResponse {
 }
 /// Nested message and enum types in `DeterministicAeadEncryptResponse`.
 pub mod deterministic_aead_encrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -218,7 +193,6 @@ pub mod deterministic_aead_encrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct DeterministicAeadDecryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -229,7 +203,6 @@ pub struct DeterministicAeadDecryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub associated_data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct DeterministicAeadDecryptResponse {
     #[prost(oneof = "deterministic_aead_decrypt_response::Result", tags = "1, 2")]
@@ -237,7 +210,6 @@ pub struct DeterministicAeadDecryptResponse {
 }
 /// Nested message and enum types in `DeterministicAeadDecryptResponse`.
 pub mod deterministic_aead_decrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -246,7 +218,6 @@ pub mod deterministic_aead_decrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct StreamingAeadEncryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -257,7 +228,6 @@ pub struct StreamingAeadEncryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub associated_data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct StreamingAeadEncryptResponse {
     #[prost(oneof = "streaming_aead_encrypt_response::Result", tags = "1, 2")]
@@ -265,7 +235,6 @@ pub struct StreamingAeadEncryptResponse {
 }
 /// Nested message and enum types in `StreamingAeadEncryptResponse`.
 pub mod streaming_aead_encrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -274,7 +243,6 @@ pub mod streaming_aead_encrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct StreamingAeadDecryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -285,7 +253,6 @@ pub struct StreamingAeadDecryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub associated_data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct StreamingAeadDecryptResponse {
     #[prost(oneof = "streaming_aead_decrypt_response::Result", tags = "1, 2")]
@@ -293,7 +260,6 @@ pub struct StreamingAeadDecryptResponse {
 }
 /// Nested message and enum types in `StreamingAeadDecryptResponse`.
 pub mod streaming_aead_decrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -302,7 +268,6 @@ pub mod streaming_aead_decrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct ComputeMacRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -311,7 +276,6 @@ pub struct ComputeMacRequest {
     #[prost(bytes = "vec", tag = "2")]
     pub data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct ComputeMacResponse {
     #[prost(oneof = "compute_mac_response::Result", tags = "1, 2")]
@@ -319,7 +283,6 @@ pub struct ComputeMacResponse {
 }
 /// Nested message and enum types in `ComputeMacResponse`.
 pub mod compute_mac_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -328,7 +291,6 @@ pub mod compute_mac_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct VerifyMacRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -339,13 +301,11 @@ pub struct VerifyMacRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct VerifyMacResponse {
     #[prost(string, tag = "1")]
     pub err: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HybridEncryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -356,7 +316,6 @@ pub struct HybridEncryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub context_info: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HybridEncryptResponse {
     #[prost(oneof = "hybrid_encrypt_response::Result", tags = "1, 2")]
@@ -364,7 +323,6 @@ pub struct HybridEncryptResponse {
 }
 /// Nested message and enum types in `HybridEncryptResponse`.
 pub mod hybrid_encrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -373,7 +331,6 @@ pub mod hybrid_encrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HybridDecryptRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -384,7 +341,6 @@ pub struct HybridDecryptRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub context_info: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct HybridDecryptResponse {
     #[prost(oneof = "hybrid_decrypt_response::Result", tags = "1, 2")]
@@ -392,7 +348,6 @@ pub struct HybridDecryptResponse {
 }
 /// Nested message and enum types in `HybridDecryptResponse`.
 pub mod hybrid_decrypt_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -401,7 +356,6 @@ pub mod hybrid_decrypt_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct SignatureSignRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -410,7 +364,6 @@ pub struct SignatureSignRequest {
     #[prost(bytes = "vec", tag = "2")]
     pub data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct SignatureSignResponse {
     #[prost(oneof = "signature_sign_response::Result", tags = "1, 2")]
@@ -418,7 +371,6 @@ pub struct SignatureSignResponse {
 }
 /// Nested message and enum types in `SignatureSignResponse`.
 pub mod signature_sign_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -427,7 +379,6 @@ pub mod signature_sign_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct SignatureVerifyRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -438,20 +389,17 @@ pub struct SignatureVerifyRequest {
     #[prost(bytes = "vec", tag = "3")]
     pub data: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct SignatureVerifyResponse {
     #[prost(string, tag = "1")]
     pub err: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfSetKeyIdsRequest {
     /// serialized google.crypto.tink.Keyset.
     #[prost(bytes = "vec", tag = "1")]
     pub keyset: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfSetKeyIdsResponse {
     #[prost(oneof = "prf_set_key_ids_response::Result", tags = "1, 2")]
@@ -459,7 +407,6 @@ pub struct PrfSetKeyIdsResponse {
 }
 /// Nested message and enum types in `PrfSetKeyIdsResponse`.
 pub mod prf_set_key_ids_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Message)]
     pub struct Output {
         #[prost(uint32, tag = "1")]
@@ -467,7 +414,6 @@ pub mod prf_set_key_ids_response {
         #[prost(uint32, repeated, tag = "2")]
         pub key_id: ::prost::alloc::vec::Vec<u32>,
     }
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(message, tag = "1")]
@@ -476,7 +422,6 @@ pub mod prf_set_key_ids_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfSetComputeRequest {
     /// serialized google.crypto.tink.Keyset.
@@ -489,7 +434,6 @@ pub struct PrfSetComputeRequest {
     #[prost(int32, tag = "4")]
     pub output_length: i32,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct PrfSetComputeResponse {
     #[prost(oneof = "prf_set_compute_response::Result", tags = "1, 2")]
@@ -497,7 +441,6 @@ pub struct PrfSetComputeResponse {
 }
 /// Nested message and enum types in `PrfSetComputeResponse`.
 pub mod prf_set_compute_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(bytes, tag = "1")]
@@ -507,8 +450,7 @@ pub mod prf_set_compute_response {
     }
 }
 /// Copied from timestamp.proto
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Timestamp {
     /// Represents seconds of UTC time since Unix epoch
     /// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
@@ -523,8 +465,7 @@ pub struct Timestamp {
     pub nanos: i32,
 }
 /// Copied from duration.proto
-#[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Duration {
     /// Signed seconds of the span of time. Must be from -315,576,000,000
     /// to +315,576,000,000 inclusive. Note: these bounds are computed from:
@@ -541,14 +482,12 @@ pub struct Duration {
     pub nanos: i32,
 }
 /// Copied from wrappers.proto
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct StringValue {
     /// The string value.
     #[prost(string, tag = "1")]
     pub value: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtClaimValue {
     #[prost(oneof = "jwt_claim_value::Kind", tags = "2, 3, 4, 5, 6, 7")]
@@ -556,7 +495,6 @@ pub struct JwtClaimValue {
 }
 /// Nested message and enum types in `JwtClaimValue`.
 pub mod jwt_claim_value {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Kind {
         #[prost(enumeration = "super::NullValue", tag = "2")]
@@ -573,7 +511,6 @@ pub mod jwt_claim_value {
         JsonArrayValue(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtToken {
     #[prost(message, optional, tag = "1")]
@@ -598,7 +535,6 @@ pub struct JwtToken {
     #[prost(message, optional, tag = "9")]
     pub type_header: ::core::option::Option<StringValue>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtValidator {
     #[prost(message, optional, tag = "7")]
@@ -622,7 +558,6 @@ pub struct JwtValidator {
     #[prost(message, optional, tag = "6")]
     pub clock_skew: ::core::option::Option<Duration>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtSignRequest {
     /// serialized google.crypto.tink.Keyset
@@ -631,7 +566,6 @@ pub struct JwtSignRequest {
     #[prost(message, optional, tag = "2")]
     pub raw_jwt: ::core::option::Option<JwtToken>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtSignResponse {
     #[prost(oneof = "jwt_sign_response::Result", tags = "1, 2")]
@@ -639,7 +573,6 @@ pub struct JwtSignResponse {
 }
 /// Nested message and enum types in `JwtSignResponse`.
 pub mod jwt_sign_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(string, tag = "1")]
@@ -648,7 +581,6 @@ pub mod jwt_sign_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtVerifyRequest {
     /// serialized google.crypto.tink.Keyset
@@ -659,7 +591,6 @@ pub struct JwtVerifyRequest {
     #[prost(message, optional, tag = "3")]
     pub validator: ::core::option::Option<JwtValidator>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtVerifyResponse {
     #[prost(oneof = "jwt_verify_response::Result", tags = "1, 2")]
@@ -667,7 +598,6 @@ pub struct JwtVerifyResponse {
 }
 /// Nested message and enum types in `JwtVerifyResponse`.
 pub mod jwt_verify_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(message, tag = "1")]
@@ -676,14 +606,12 @@ pub mod jwt_verify_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtToJwkSetRequest {
     /// serialized google.crypto.tink.Keyset.
     #[prost(bytes = "vec", tag = "1")]
     pub keyset: ::prost::alloc::vec::Vec<u8>,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtToJwkSetResponse {
     #[prost(oneof = "jwt_to_jwk_set_response::Result", tags = "1, 2")]
@@ -691,7 +619,6 @@ pub struct JwtToJwkSetResponse {
 }
 /// Nested message and enum types in `JwtToJwkSetResponse`.
 pub mod jwt_to_jwk_set_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         #[prost(string, tag = "1")]
@@ -700,13 +627,11 @@ pub mod jwt_to_jwk_set_response {
         Err(::prost::alloc::string::String),
     }
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtFromJwkSetRequest {
     #[prost(string, tag = "1")]
     pub jwk_set: ::prost::alloc::string::String,
 }
-#[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct JwtFromJwkSetResponse {
     #[prost(oneof = "jwt_from_jwk_set_response::Result", tags = "1, 2")]
@@ -714,7 +639,6 @@ pub struct JwtFromJwkSetResponse {
 }
 /// Nested message and enum types in `JwtFromJwkSetResponse`.
 pub mod jwt_from_jwk_set_response {
-    #[allow(clippy::derive_partial_eq_without_eq)]
     #[derive(Clone, PartialEq, ::prost::Oneof)]
     pub enum Result {
         /// serialized google.crypto.tink.Keyset.
@@ -737,7 +661,7 @@ impl NullValue {
     /// (if the ProtoBuf definition does not change) and safe for programmatic use.
     pub fn as_str_name(&self) -> &'static str {
         match self {
-            NullValue::NullValue => "NULL_VALUE",
+            Self::NullValue => "NULL_VALUE",
         }
     }
     /// Creates an enum from field names used in the ProtoBuf definition.
@@ -750,7 +674,13 @@ impl NullValue {
 }
 /// Generated client implementations.
 pub mod metadata_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service providing metadata about the server.
@@ -762,7 +692,7 @@ pub mod metadata_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -773,8 +703,8 @@ pub mod metadata_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -799,7 +729,7 @@ pub mod metadata_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             MetadataClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -818,18 +748,36 @@ pub mod metadata_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Returns some server information. A test may use this information to verify
         /// that it is talking to the right server.
         pub async fn get_server_info(
             &mut self,
             request: impl tonic::IntoRequest<super::ServerInfoRequest>,
-        ) -> Result<tonic::Response<super::ServerInfoResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::ServerInfoResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -837,13 +785,22 @@ pub mod metadata_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Metadata/GetServerInfo",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Metadata", "GetServerInfo"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod keyset_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service for Keyset operations.
@@ -855,7 +812,7 @@ pub mod keyset_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -866,8 +823,8 @@ pub mod keyset_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -892,7 +849,7 @@ pub mod keyset_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             KeysetClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -911,17 +868,35 @@ pub mod keyset_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Generates a key template from a key template name.
         pub async fn get_template(
             &mut self,
             request: impl tonic::IntoRequest<super::KeysetTemplateRequest>,
-        ) -> Result<tonic::Response<super::KeysetTemplateResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetTemplateResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -929,19 +904,24 @@ pub mod keyset_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Keyset/GetTemplate",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Keyset", "GetTemplate"));
+            self.inner.unary(req, path, codec).await
         }
         /// Generates a new keyset from a template.
         pub async fn generate(
             &mut self,
             request: impl tonic::IntoRequest<super::KeysetGenerateRequest>,
-        ) -> Result<tonic::Response<super::KeysetGenerateResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetGenerateResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -949,19 +929,24 @@ pub mod keyset_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Keyset/Generate",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Keyset", "Generate"));
+            self.inner.unary(req, path, codec).await
         }
         /// Generates a public-key keyset from a private-key keyset.
         pub async fn public(
             &mut self,
             request: impl tonic::IntoRequest<super::KeysetPublicRequest>,
-        ) -> Result<tonic::Response<super::KeysetPublicResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetPublicResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -969,19 +954,24 @@ pub mod keyset_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Keyset/Public",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Keyset", "Public"));
+            self.inner.unary(req, path, codec).await
         }
         /// Converts a Keyset from Binary to Json Format
         pub async fn to_json(
             &mut self,
             request: impl tonic::IntoRequest<super::KeysetToJsonRequest>,
-        ) -> Result<tonic::Response<super::KeysetToJsonResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetToJsonResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -989,19 +979,24 @@ pub mod keyset_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Keyset/ToJson",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Keyset", "ToJson"));
+            self.inner.unary(req, path, codec).await
         }
         /// Converts a Keyset from Json to Binary Format
         pub async fn from_json(
             &mut self,
             request: impl tonic::IntoRequest<super::KeysetFromJsonRequest>,
-        ) -> Result<tonic::Response<super::KeysetFromJsonResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetFromJsonResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1009,13 +1004,22 @@ pub mod keyset_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Keyset/FromJson",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Keyset", "FromJson"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod aead_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service for AEAD encryption and decryption
@@ -1027,7 +1031,7 @@ pub mod aead_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1038,8 +1042,8 @@ pub mod aead_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1064,7 +1068,7 @@ pub mod aead_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             AeadClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1083,17 +1087,35 @@ pub mod aead_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Encrypts a plaintext with the provided keyset
         pub async fn encrypt(
             &mut self,
             request: impl tonic::IntoRequest<super::AeadEncryptRequest>,
-        ) -> Result<tonic::Response<super::AeadEncryptResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::AeadEncryptResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1101,19 +1123,24 @@ pub mod aead_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Aead/Encrypt",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Aead", "Encrypt"));
+            self.inner.unary(req, path, codec).await
         }
         /// Decrypts a ciphertext with the provided keyset
         pub async fn decrypt(
             &mut self,
             request: impl tonic::IntoRequest<super::AeadDecryptRequest>,
-        ) -> Result<tonic::Response<super::AeadDecryptResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::AeadDecryptResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1121,13 +1148,22 @@ pub mod aead_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Aead/Decrypt",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Aead", "Decrypt"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod deterministic_aead_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service for Deterministic AEAD encryption and decryption
@@ -1139,7 +1175,7 @@ pub mod deterministic_aead_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1150,8 +1186,8 @@ pub mod deterministic_aead_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1176,7 +1212,7 @@ pub mod deterministic_aead_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             DeterministicAeadClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1195,11 +1231,27 @@ pub mod deterministic_aead_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Encrypts a plaintext with the provided keyset
         pub async fn encrypt_deterministically(
             &mut self,
             request: impl tonic::IntoRequest<super::DeterministicAeadEncryptRequest>,
-        ) -> Result<
+        ) -> std::result::Result<
             tonic::Response<super::DeterministicAeadEncryptResponse>,
             tonic::Status,
         > {
@@ -1207,8 +1259,7 @@ pub mod deterministic_aead_client {
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1216,13 +1267,21 @@ pub mod deterministic_aead_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.DeterministicAead/EncryptDeterministically",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new(
+                        "tink_testing_api.DeterministicAead",
+                        "EncryptDeterministically",
+                    ),
+                );
+            self.inner.unary(req, path, codec).await
         }
         /// Decrypts a ciphertext with the provided keyset
         pub async fn decrypt_deterministically(
             &mut self,
             request: impl tonic::IntoRequest<super::DeterministicAeadDecryptRequest>,
-        ) -> Result<
+        ) -> std::result::Result<
             tonic::Response<super::DeterministicAeadDecryptResponse>,
             tonic::Status,
         > {
@@ -1230,8 +1289,7 @@ pub mod deterministic_aead_client {
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1239,13 +1297,27 @@ pub mod deterministic_aead_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.DeterministicAead/DecryptDeterministically",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new(
+                        "tink_testing_api.DeterministicAead",
+                        "DecryptDeterministically",
+                    ),
+                );
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod streaming_aead_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service for Streaming AEAD encryption and decryption
@@ -1257,7 +1329,7 @@ pub mod streaming_aead_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1268,8 +1340,8 @@ pub mod streaming_aead_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1294,7 +1366,7 @@ pub mod streaming_aead_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             StreamingAeadClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1313,11 +1385,27 @@ pub mod streaming_aead_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Encrypts a plaintext with the provided keyset
         pub async fn encrypt(
             &mut self,
             request: impl tonic::IntoRequest<super::StreamingAeadEncryptRequest>,
-        ) -> Result<
+        ) -> std::result::Result<
             tonic::Response<super::StreamingAeadEncryptResponse>,
             tonic::Status,
         > {
@@ -1325,8 +1413,7 @@ pub mod streaming_aead_client {
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1334,13 +1421,16 @@ pub mod streaming_aead_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.StreamingAead/Encrypt",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.StreamingAead", "Encrypt"));
+            self.inner.unary(req, path, codec).await
         }
         /// Decrypts a ciphertext with the provided keyset
         pub async fn decrypt(
             &mut self,
             request: impl tonic::IntoRequest<super::StreamingAeadDecryptRequest>,
-        ) -> Result<
+        ) -> std::result::Result<
             tonic::Response<super::StreamingAeadDecryptResponse>,
             tonic::Status,
         > {
@@ -1348,8 +1438,7 @@ pub mod streaming_aead_client {
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1357,13 +1446,22 @@ pub mod streaming_aead_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.StreamingAead/Decrypt",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.StreamingAead", "Decrypt"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod mac_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service to compute and verify MACs
@@ -1375,7 +1473,7 @@ pub mod mac_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1386,8 +1484,8 @@ pub mod mac_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1412,7 +1510,7 @@ pub mod mac_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             MacClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1431,17 +1529,35 @@ pub mod mac_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Computes a MAC for given data
         pub async fn compute_mac(
             &mut self,
             request: impl tonic::IntoRequest<super::ComputeMacRequest>,
-        ) -> Result<tonic::Response<super::ComputeMacResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::ComputeMacResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1449,19 +1565,24 @@ pub mod mac_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Mac/ComputeMac",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Mac", "ComputeMac"));
+            self.inner.unary(req, path, codec).await
         }
         /// Verifies the validity of the MAC value, no error means success
         pub async fn verify_mac(
             &mut self,
             request: impl tonic::IntoRequest<super::VerifyMacRequest>,
-        ) -> Result<tonic::Response<super::VerifyMacResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::VerifyMacResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1469,13 +1590,22 @@ pub mod mac_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Mac/VerifyMac",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Mac", "VerifyMac"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod hybrid_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service to hybrid encrypt and decrypt
@@ -1487,7 +1617,7 @@ pub mod hybrid_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1498,8 +1628,8 @@ pub mod hybrid_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1524,7 +1654,7 @@ pub mod hybrid_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             HybridClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1543,17 +1673,35 @@ pub mod hybrid_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Encrypts plaintext binding context_info to the resulting ciphertext
         pub async fn encrypt(
             &mut self,
             request: impl tonic::IntoRequest<super::HybridEncryptRequest>,
-        ) -> Result<tonic::Response<super::HybridEncryptResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::HybridEncryptResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1561,19 +1709,24 @@ pub mod hybrid_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Hybrid/Encrypt",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Hybrid", "Encrypt"));
+            self.inner.unary(req, path, codec).await
         }
         /// Decrypts ciphertext verifying the integrity of context_info
         pub async fn decrypt(
             &mut self,
             request: impl tonic::IntoRequest<super::HybridDecryptRequest>,
-        ) -> Result<tonic::Response<super::HybridDecryptResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::HybridDecryptResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1581,13 +1734,22 @@ pub mod hybrid_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Hybrid/Decrypt",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Hybrid", "Decrypt"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod signature_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service to sign and verify signatures.
@@ -1599,7 +1761,7 @@ pub mod signature_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1610,8 +1772,8 @@ pub mod signature_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1636,7 +1798,7 @@ pub mod signature_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             SignatureClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1655,17 +1817,35 @@ pub mod signature_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Computes the signature for data
         pub async fn sign(
             &mut self,
             request: impl tonic::IntoRequest<super::SignatureSignRequest>,
-        ) -> Result<tonic::Response<super::SignatureSignResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::SignatureSignResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1673,19 +1853,24 @@ pub mod signature_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Signature/Sign",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Signature", "Sign"));
+            self.inner.unary(req, path, codec).await
         }
         /// Verifies that signature is a digital signature for data
         pub async fn verify(
             &mut self,
             request: impl tonic::IntoRequest<super::SignatureVerifyRequest>,
-        ) -> Result<tonic::Response<super::SignatureVerifyResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::SignatureVerifyResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1693,13 +1878,22 @@ pub mod signature_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Signature/Verify",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Signature", "Verify"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod prf_set_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service for PrfSet computation
@@ -1711,7 +1905,7 @@ pub mod prf_set_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1722,8 +1916,8 @@ pub mod prf_set_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1748,7 +1942,7 @@ pub mod prf_set_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             PrfSetClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1767,17 +1961,35 @@ pub mod prf_set_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Returns the key ids and the primary key id in the keyset.
         pub async fn key_ids(
             &mut self,
             request: impl tonic::IntoRequest<super::PrfSetKeyIdsRequest>,
-        ) -> Result<tonic::Response<super::PrfSetKeyIdsResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::PrfSetKeyIdsResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1785,19 +1997,24 @@ pub mod prf_set_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.PrfSet/KeyIds",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.PrfSet", "KeyIds"));
+            self.inner.unary(req, path, codec).await
         }
         /// Computes the output of the PRF with the given key_id in the PrfSet.
         pub async fn compute(
             &mut self,
             request: impl tonic::IntoRequest<super::PrfSetComputeRequest>,
-        ) -> Result<tonic::Response<super::PrfSetComputeResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::PrfSetComputeResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1805,13 +2022,22 @@ pub mod prf_set_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.PrfSet/Compute",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.PrfSet", "Compute"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated client implementations.
 pub mod jwt_client {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     use tonic::codegen::http::Uri;
     /// Service for JSON Web Tokens (JWT)
@@ -1823,7 +2049,7 @@ pub mod jwt_client {
         /// Attempt to create a new client by connecting to a given endpoint.
         pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
         where
-            D: std::convert::TryInto<tonic::transport::Endpoint>,
+            D: TryInto<tonic::transport::Endpoint>,
             D::Error: Into<StdError>,
         {
             let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
@@ -1834,8 +2060,8 @@ pub mod jwt_client {
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
         T::Error: Into<StdError>,
-        T::ResponseBody: Body<Data = Bytes> + Send + 'static,
-        <T::ResponseBody as Body>::Error: Into<StdError> + Send,
+        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
+        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
     {
         pub fn new(inner: T) -> Self {
             let inner = tonic::client::Grpc::new(inner);
@@ -1860,7 +2086,7 @@ pub mod jwt_client {
             >,
             <T as tonic::codegen::Service<
                 http::Request<tonic::body::BoxBody>,
-            >>::Error: Into<StdError> + Send + Sync,
+            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             JwtClient::new(InterceptedService::new(inner, interceptor))
         }
@@ -1879,17 +2105,35 @@ pub mod jwt_client {
             self.inner = self.inner.accept_compressed(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_decoding_message_size(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.inner = self.inner.max_encoding_message_size(limit);
+            self
+        }
         /// Computes a signed compact JWT token.
         pub async fn compute_mac_and_encode(
             &mut self,
             request: impl tonic::IntoRequest<super::JwtSignRequest>,
-        ) -> Result<tonic::Response<super::JwtSignResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::JwtSignResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1897,19 +2141,24 @@ pub mod jwt_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Jwt/ComputeMacAndEncode",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Jwt", "ComputeMacAndEncode"));
+            self.inner.unary(req, path, codec).await
         }
         /// Verifies the validity of the signed compact JWT token
         pub async fn verify_mac_and_decode(
             &mut self,
             request: impl tonic::IntoRequest<super::JwtVerifyRequest>,
-        ) -> Result<tonic::Response<super::JwtVerifyResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::JwtVerifyResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1917,19 +2166,24 @@ pub mod jwt_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Jwt/VerifyMacAndDecode",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Jwt", "VerifyMacAndDecode"));
+            self.inner.unary(req, path, codec).await
         }
         /// Computes a signed compact JWT token.
         pub async fn public_key_sign_and_encode(
             &mut self,
             request: impl tonic::IntoRequest<super::JwtSignRequest>,
-        ) -> Result<tonic::Response<super::JwtSignResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::JwtSignResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1937,19 +2191,26 @@ pub mod jwt_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Jwt/PublicKeySignAndEncode",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new("tink_testing_api.Jwt", "PublicKeySignAndEncode"),
+                );
+            self.inner.unary(req, path, codec).await
         }
         /// Verifies the validity of the signed compact JWT token
         pub async fn public_key_verify_and_decode(
             &mut self,
             request: impl tonic::IntoRequest<super::JwtVerifyRequest>,
-        ) -> Result<tonic::Response<super::JwtVerifyResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::JwtVerifyResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1957,19 +2218,26 @@ pub mod jwt_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Jwt/PublicKeyVerifyAndDecode",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new("tink_testing_api.Jwt", "PublicKeyVerifyAndDecode"),
+                );
+            self.inner.unary(req, path, codec).await
         }
         /// Converts a Keyset from Tink Binary to JWK Set Format
         pub async fn to_jwk_set(
             &mut self,
             request: impl tonic::IntoRequest<super::JwtToJwkSetRequest>,
-        ) -> Result<tonic::Response<super::JwtToJwkSetResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::JwtToJwkSetResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1977,19 +2245,24 @@ pub mod jwt_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Jwt/ToJwkSet",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Jwt", "ToJwkSet"));
+            self.inner.unary(req, path, codec).await
         }
         /// Converts a Keyset from JWK Set to Tink Binary Format
         pub async fn from_jwk_set(
             &mut self,
             request: impl tonic::IntoRequest<super::JwtFromJwkSetRequest>,
-        ) -> Result<tonic::Response<super::JwtFromJwkSetResponse>, tonic::Status> {
+        ) -> std::result::Result<
+            tonic::Response<super::JwtFromJwkSetResponse>,
+            tonic::Status,
+        > {
             self.inner
                 .ready()
                 .await
                 .map_err(|e| {
-                    tonic::Status::new(
-                        tonic::Code::Unknown,
+                    tonic::Status::unknown(
                         format!("Service was not ready: {}", e.into()),
                     )
                 })?;
@@ -1997,42 +2270,56 @@ pub mod jwt_client {
             let path = http::uri::PathAndQuery::from_static(
                 "/tink_testing_api.Jwt/FromJwkSet",
             );
-            self.inner.unary(request.into_request(), path, codec).await
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(GrpcMethod::new("tink_testing_api.Jwt", "FromJwkSet"));
+            self.inner.unary(req, path, codec).await
         }
     }
 }
 /// Generated server implementations.
 pub mod metadata_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with MetadataServer.
     #[async_trait]
-    pub trait Metadata: Send + Sync + 'static {
+    pub trait Metadata: std::marker::Send + std::marker::Sync + 'static {
         /// Returns some server information. A test may use this information to verify
         /// that it is talking to the right server.
         async fn get_server_info(
             &self,
             request: tonic::Request<super::ServerInfoRequest>,
-        ) -> Result<tonic::Response<super::ServerInfoResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::ServerInfoResponse>,
+            tonic::Status,
+        >;
     }
     /// Service providing metadata about the server.
     #[derive(Debug)]
-    pub struct MetadataServer<T: Metadata> {
-        inner: _Inner<T>,
+    pub struct MetadataServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Metadata> MetadataServer<T> {
+    impl<T> MetadataServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -2056,12 +2343,28 @@ pub mod metadata_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for MetadataServer<T>
     where
         T: Metadata,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -2069,11 +2372,10 @@ pub mod metadata_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Metadata/GetServerInfo" => {
                     #[allow(non_camel_case_types)]
@@ -2091,24 +2393,29 @@ pub mod metadata_server {
                             &mut self,
                             request: tonic::Request<super::ServerInfoRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).get_server_info(request).await
+                                <T as Metadata>::get_server_info(&inner, request).await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = GetServerInfoSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2117,94 +2424,116 @@ pub mod metadata_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Metadata> Clone for MetadataServer<T> {
+    impl<T> Clone for MetadataServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Metadata> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Metadata> tonic::server::NamedService for MetadataServer<T> {
-        const NAME: &'static str = "tink_testing_api.Metadata";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Metadata";
+    impl<T> tonic::server::NamedService for MetadataServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod keyset_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with KeysetServer.
     #[async_trait]
-    pub trait Keyset: Send + Sync + 'static {
+    pub trait Keyset: std::marker::Send + std::marker::Sync + 'static {
         /// Generates a key template from a key template name.
         async fn get_template(
             &self,
             request: tonic::Request<super::KeysetTemplateRequest>,
-        ) -> Result<tonic::Response<super::KeysetTemplateResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetTemplateResponse>,
+            tonic::Status,
+        >;
         /// Generates a new keyset from a template.
         async fn generate(
             &self,
             request: tonic::Request<super::KeysetGenerateRequest>,
-        ) -> Result<tonic::Response<super::KeysetGenerateResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetGenerateResponse>,
+            tonic::Status,
+        >;
         /// Generates a public-key keyset from a private-key keyset.
         async fn public(
             &self,
             request: tonic::Request<super::KeysetPublicRequest>,
-        ) -> Result<tonic::Response<super::KeysetPublicResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetPublicResponse>,
+            tonic::Status,
+        >;
         /// Converts a Keyset from Binary to Json Format
         async fn to_json(
             &self,
             request: tonic::Request<super::KeysetToJsonRequest>,
-        ) -> Result<tonic::Response<super::KeysetToJsonResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetToJsonResponse>,
+            tonic::Status,
+        >;
         /// Converts a Keyset from Json to Binary Format
         async fn from_json(
             &self,
             request: tonic::Request<super::KeysetFromJsonRequest>,
-        ) -> Result<tonic::Response<super::KeysetFromJsonResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::KeysetFromJsonResponse>,
+            tonic::Status,
+        >;
     }
     /// Service for Keyset operations.
     #[derive(Debug)]
-    pub struct KeysetServer<T: Keyset> {
-        inner: _Inner<T>,
+    pub struct KeysetServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Keyset> KeysetServer<T> {
+    impl<T> KeysetServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -2228,12 +2557,28 @@ pub mod keyset_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for KeysetServer<T>
     where
         T: Keyset,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -2241,11 +2586,10 @@ pub mod keyset_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Keyset/GetTemplate" => {
                     #[allow(non_camel_case_types)]
@@ -2263,24 +2607,29 @@ pub mod keyset_server {
                             &mut self,
                             request: tonic::Request<super::KeysetTemplateRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).get_template(request).await
+                                <T as Keyset>::get_template(&inner, request).await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = GetTemplateSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2303,22 +2652,29 @@ pub mod keyset_server {
                             &mut self,
                             request: tonic::Request<super::KeysetGenerateRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).generate(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Keyset>::generate(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = GenerateSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2341,22 +2697,29 @@ pub mod keyset_server {
                             &mut self,
                             request: tonic::Request<super::KeysetPublicRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).public(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Keyset>::public(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = PublicSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2379,22 +2742,29 @@ pub mod keyset_server {
                             &mut self,
                             request: tonic::Request<super::KeysetToJsonRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).to_json(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Keyset>::to_json(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = ToJsonSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2417,22 +2787,29 @@ pub mod keyset_server {
                             &mut self,
                             request: tonic::Request<super::KeysetFromJsonRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).from_json(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Keyset>::from_json(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = FromJsonSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2441,79 +2818,92 @@ pub mod keyset_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Keyset> Clone for KeysetServer<T> {
+    impl<T> Clone for KeysetServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Keyset> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Keyset> tonic::server::NamedService for KeysetServer<T> {
-        const NAME: &'static str = "tink_testing_api.Keyset";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Keyset";
+    impl<T> tonic::server::NamedService for KeysetServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod aead_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with AeadServer.
     #[async_trait]
-    pub trait Aead: Send + Sync + 'static {
+    pub trait Aead: std::marker::Send + std::marker::Sync + 'static {
         /// Encrypts a plaintext with the provided keyset
         async fn encrypt(
             &self,
             request: tonic::Request<super::AeadEncryptRequest>,
-        ) -> Result<tonic::Response<super::AeadEncryptResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::AeadEncryptResponse>,
+            tonic::Status,
+        >;
         /// Decrypts a ciphertext with the provided keyset
         async fn decrypt(
             &self,
             request: tonic::Request<super::AeadDecryptRequest>,
-        ) -> Result<tonic::Response<super::AeadDecryptResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::AeadDecryptResponse>,
+            tonic::Status,
+        >;
     }
     /// Service for AEAD encryption and decryption
     #[derive(Debug)]
-    pub struct AeadServer<T: Aead> {
-        inner: _Inner<T>,
+    pub struct AeadServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Aead> AeadServer<T> {
+    impl<T> AeadServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -2537,12 +2927,28 @@ pub mod aead_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for AeadServer<T>
     where
         T: Aead,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -2550,11 +2956,10 @@ pub mod aead_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Aead/Encrypt" => {
                     #[allow(non_camel_case_types)]
@@ -2570,22 +2975,29 @@ pub mod aead_server {
                             &mut self,
                             request: tonic::Request<super::AeadEncryptRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).encrypt(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Aead>::encrypt(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = EncryptSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2606,22 +3018,29 @@ pub mod aead_server {
                             &mut self,
                             request: tonic::Request<super::AeadDecryptRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).decrypt(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Aead>::decrypt(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = DecryptSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2630,55 +3049,60 @@ pub mod aead_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Aead> Clone for AeadServer<T> {
+    impl<T> Clone for AeadServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Aead> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Aead> tonic::server::NamedService for AeadServer<T> {
-        const NAME: &'static str = "tink_testing_api.Aead";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Aead";
+    impl<T> tonic::server::NamedService for AeadServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod deterministic_aead_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with DeterministicAeadServer.
     #[async_trait]
-    pub trait DeterministicAead: Send + Sync + 'static {
+    pub trait DeterministicAead: std::marker::Send + std::marker::Sync + 'static {
         /// Encrypts a plaintext with the provided keyset
         async fn encrypt_deterministically(
             &self,
             request: tonic::Request<super::DeterministicAeadEncryptRequest>,
-        ) -> Result<
+        ) -> std::result::Result<
             tonic::Response<super::DeterministicAeadEncryptResponse>,
             tonic::Status,
         >;
@@ -2686,29 +3110,31 @@ pub mod deterministic_aead_server {
         async fn decrypt_deterministically(
             &self,
             request: tonic::Request<super::DeterministicAeadDecryptRequest>,
-        ) -> Result<
+        ) -> std::result::Result<
             tonic::Response<super::DeterministicAeadDecryptResponse>,
             tonic::Status,
         >;
     }
     /// Service for Deterministic AEAD encryption and decryption
     #[derive(Debug)]
-    pub struct DeterministicAeadServer<T: DeterministicAead> {
-        inner: _Inner<T>,
+    pub struct DeterministicAeadServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: DeterministicAead> DeterministicAeadServer<T> {
+    impl<T> DeterministicAeadServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -2732,12 +3158,28 @@ pub mod deterministic_aead_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for DeterministicAeadServer<T>
     where
         T: DeterministicAead,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -2745,11 +3187,10 @@ pub mod deterministic_aead_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.DeterministicAead/EncryptDeterministically" => {
                     #[allow(non_camel_case_types)]
@@ -2769,24 +3210,33 @@ pub mod deterministic_aead_server {
                                 super::DeterministicAeadEncryptRequest,
                             >,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).encrypt_deterministically(request).await
+                                <T as DeterministicAead>::encrypt_deterministically(
+                                        &inner,
+                                        request,
+                                    )
+                                    .await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = EncryptDeterministicallySvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2811,24 +3261,33 @@ pub mod deterministic_aead_server {
                                 super::DeterministicAeadDecryptRequest,
                             >,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).decrypt_deterministically(request).await
+                                <T as DeterministicAead>::decrypt_deterministically(
+                                        &inner,
+                                        request,
+                                    )
+                                    .await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = DecryptDeterministicallySvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -2837,80 +3296,92 @@ pub mod deterministic_aead_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: DeterministicAead> Clone for DeterministicAeadServer<T> {
+    impl<T> Clone for DeterministicAeadServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: DeterministicAead> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: DeterministicAead> tonic::server::NamedService
-    for DeterministicAeadServer<T> {
-        const NAME: &'static str = "tink_testing_api.DeterministicAead";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.DeterministicAead";
+    impl<T> tonic::server::NamedService for DeterministicAeadServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod streaming_aead_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with StreamingAeadServer.
     #[async_trait]
-    pub trait StreamingAead: Send + Sync + 'static {
+    pub trait StreamingAead: std::marker::Send + std::marker::Sync + 'static {
         /// Encrypts a plaintext with the provided keyset
         async fn encrypt(
             &self,
             request: tonic::Request<super::StreamingAeadEncryptRequest>,
-        ) -> Result<tonic::Response<super::StreamingAeadEncryptResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::StreamingAeadEncryptResponse>,
+            tonic::Status,
+        >;
         /// Decrypts a ciphertext with the provided keyset
         async fn decrypt(
             &self,
             request: tonic::Request<super::StreamingAeadDecryptRequest>,
-        ) -> Result<tonic::Response<super::StreamingAeadDecryptResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::StreamingAeadDecryptResponse>,
+            tonic::Status,
+        >;
     }
     /// Service for Streaming AEAD encryption and decryption
     #[derive(Debug)]
-    pub struct StreamingAeadServer<T: StreamingAead> {
-        inner: _Inner<T>,
+    pub struct StreamingAeadServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: StreamingAead> StreamingAeadServer<T> {
+    impl<T> StreamingAeadServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -2934,12 +3405,28 @@ pub mod streaming_aead_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for StreamingAeadServer<T>
     where
         T: StreamingAead,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -2947,11 +3434,10 @@ pub mod streaming_aead_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.StreamingAead/Encrypt" => {
                     #[allow(non_camel_case_types)]
@@ -2969,22 +3455,29 @@ pub mod streaming_aead_server {
                             &mut self,
                             request: tonic::Request<super::StreamingAeadEncryptRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).encrypt(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as StreamingAead>::encrypt(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = EncryptSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3007,22 +3500,29 @@ pub mod streaming_aead_server {
                             &mut self,
                             request: tonic::Request<super::StreamingAeadDecryptRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).decrypt(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as StreamingAead>::decrypt(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = DecryptSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3031,79 +3531,92 @@ pub mod streaming_aead_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: StreamingAead> Clone for StreamingAeadServer<T> {
+    impl<T> Clone for StreamingAeadServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: StreamingAead> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: StreamingAead> tonic::server::NamedService for StreamingAeadServer<T> {
-        const NAME: &'static str = "tink_testing_api.StreamingAead";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.StreamingAead";
+    impl<T> tonic::server::NamedService for StreamingAeadServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod mac_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with MacServer.
     #[async_trait]
-    pub trait Mac: Send + Sync + 'static {
+    pub trait Mac: std::marker::Send + std::marker::Sync + 'static {
         /// Computes a MAC for given data
         async fn compute_mac(
             &self,
             request: tonic::Request<super::ComputeMacRequest>,
-        ) -> Result<tonic::Response<super::ComputeMacResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::ComputeMacResponse>,
+            tonic::Status,
+        >;
         /// Verifies the validity of the MAC value, no error means success
         async fn verify_mac(
             &self,
             request: tonic::Request<super::VerifyMacRequest>,
-        ) -> Result<tonic::Response<super::VerifyMacResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::VerifyMacResponse>,
+            tonic::Status,
+        >;
     }
     /// Service to compute and verify MACs
     #[derive(Debug)]
-    pub struct MacServer<T: Mac> {
-        inner: _Inner<T>,
+    pub struct MacServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Mac> MacServer<T> {
+    impl<T> MacServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -3127,12 +3640,28 @@ pub mod mac_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for MacServer<T>
     where
         T: Mac,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -3140,11 +3669,10 @@ pub mod mac_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Mac/ComputeMac" => {
                     #[allow(non_camel_case_types)]
@@ -3160,22 +3688,29 @@ pub mod mac_server {
                             &mut self,
                             request: tonic::Request<super::ComputeMacRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).compute_mac(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Mac>::compute_mac(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = ComputeMacSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3196,22 +3731,29 @@ pub mod mac_server {
                             &mut self,
                             request: tonic::Request<super::VerifyMacRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).verify_mac(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Mac>::verify_mac(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = VerifyMacSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3220,79 +3762,92 @@ pub mod mac_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Mac> Clone for MacServer<T> {
+    impl<T> Clone for MacServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Mac> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Mac> tonic::server::NamedService for MacServer<T> {
-        const NAME: &'static str = "tink_testing_api.Mac";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Mac";
+    impl<T> tonic::server::NamedService for MacServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod hybrid_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with HybridServer.
     #[async_trait]
-    pub trait Hybrid: Send + Sync + 'static {
+    pub trait Hybrid: std::marker::Send + std::marker::Sync + 'static {
         /// Encrypts plaintext binding context_info to the resulting ciphertext
         async fn encrypt(
             &self,
             request: tonic::Request<super::HybridEncryptRequest>,
-        ) -> Result<tonic::Response<super::HybridEncryptResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::HybridEncryptResponse>,
+            tonic::Status,
+        >;
         /// Decrypts ciphertext verifying the integrity of context_info
         async fn decrypt(
             &self,
             request: tonic::Request<super::HybridDecryptRequest>,
-        ) -> Result<tonic::Response<super::HybridDecryptResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::HybridDecryptResponse>,
+            tonic::Status,
+        >;
     }
     /// Service to hybrid encrypt and decrypt
     #[derive(Debug)]
-    pub struct HybridServer<T: Hybrid> {
-        inner: _Inner<T>,
+    pub struct HybridServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Hybrid> HybridServer<T> {
+    impl<T> HybridServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -3316,12 +3871,28 @@ pub mod hybrid_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for HybridServer<T>
     where
         T: Hybrid,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -3329,11 +3900,10 @@ pub mod hybrid_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Hybrid/Encrypt" => {
                     #[allow(non_camel_case_types)]
@@ -3351,22 +3921,29 @@ pub mod hybrid_server {
                             &mut self,
                             request: tonic::Request<super::HybridEncryptRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).encrypt(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Hybrid>::encrypt(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = EncryptSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3389,22 +3966,29 @@ pub mod hybrid_server {
                             &mut self,
                             request: tonic::Request<super::HybridDecryptRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).decrypt(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Hybrid>::decrypt(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = DecryptSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3413,79 +3997,92 @@ pub mod hybrid_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Hybrid> Clone for HybridServer<T> {
+    impl<T> Clone for HybridServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Hybrid> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Hybrid> tonic::server::NamedService for HybridServer<T> {
-        const NAME: &'static str = "tink_testing_api.Hybrid";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Hybrid";
+    impl<T> tonic::server::NamedService for HybridServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod signature_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with SignatureServer.
     #[async_trait]
-    pub trait Signature: Send + Sync + 'static {
+    pub trait Signature: std::marker::Send + std::marker::Sync + 'static {
         /// Computes the signature for data
         async fn sign(
             &self,
             request: tonic::Request<super::SignatureSignRequest>,
-        ) -> Result<tonic::Response<super::SignatureSignResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::SignatureSignResponse>,
+            tonic::Status,
+        >;
         /// Verifies that signature is a digital signature for data
         async fn verify(
             &self,
             request: tonic::Request<super::SignatureVerifyRequest>,
-        ) -> Result<tonic::Response<super::SignatureVerifyResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::SignatureVerifyResponse>,
+            tonic::Status,
+        >;
     }
     /// Service to sign and verify signatures.
     #[derive(Debug)]
-    pub struct SignatureServer<T: Signature> {
-        inner: _Inner<T>,
+    pub struct SignatureServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Signature> SignatureServer<T> {
+    impl<T> SignatureServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -3509,12 +4106,28 @@ pub mod signature_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for SignatureServer<T>
     where
         T: Signature,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -3522,11 +4135,10 @@ pub mod signature_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Signature/Sign" => {
                     #[allow(non_camel_case_types)]
@@ -3544,22 +4156,29 @@ pub mod signature_server {
                             &mut self,
                             request: tonic::Request<super::SignatureSignRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).sign(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Signature>::sign(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = SignSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3582,22 +4201,29 @@ pub mod signature_server {
                             &mut self,
                             request: tonic::Request<super::SignatureVerifyRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).verify(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Signature>::verify(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = VerifySvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3606,79 +4232,92 @@ pub mod signature_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Signature> Clone for SignatureServer<T> {
+    impl<T> Clone for SignatureServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Signature> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Signature> tonic::server::NamedService for SignatureServer<T> {
-        const NAME: &'static str = "tink_testing_api.Signature";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Signature";
+    impl<T> tonic::server::NamedService for SignatureServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod prf_set_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with PrfSetServer.
     #[async_trait]
-    pub trait PrfSet: Send + Sync + 'static {
+    pub trait PrfSet: std::marker::Send + std::marker::Sync + 'static {
         /// Returns the key ids and the primary key id in the keyset.
         async fn key_ids(
             &self,
             request: tonic::Request<super::PrfSetKeyIdsRequest>,
-        ) -> Result<tonic::Response<super::PrfSetKeyIdsResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::PrfSetKeyIdsResponse>,
+            tonic::Status,
+        >;
         /// Computes the output of the PRF with the given key_id in the PrfSet.
         async fn compute(
             &self,
             request: tonic::Request<super::PrfSetComputeRequest>,
-        ) -> Result<tonic::Response<super::PrfSetComputeResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::PrfSetComputeResponse>,
+            tonic::Status,
+        >;
     }
     /// Service for PrfSet computation
     #[derive(Debug)]
-    pub struct PrfSetServer<T: PrfSet> {
-        inner: _Inner<T>,
+    pub struct PrfSetServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: PrfSet> PrfSetServer<T> {
+    impl<T> PrfSetServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -3702,12 +4341,28 @@ pub mod prf_set_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for PrfSetServer<T>
     where
         T: PrfSet,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -3715,11 +4370,10 @@ pub mod prf_set_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.PrfSet/KeyIds" => {
                     #[allow(non_camel_case_types)]
@@ -3737,22 +4391,29 @@ pub mod prf_set_server {
                             &mut self,
                             request: tonic::Request<super::PrfSetKeyIdsRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).key_ids(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as PrfSet>::key_ids(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = KeyIdsSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3775,22 +4436,29 @@ pub mod prf_set_server {
                             &mut self,
                             request: tonic::Request<super::PrfSetComputeRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).compute(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as PrfSet>::compute(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = ComputeSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3799,99 +4467,118 @@ pub mod prf_set_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: PrfSet> Clone for PrfSetServer<T> {
+    impl<T> Clone for PrfSetServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: PrfSet> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: PrfSet> tonic::server::NamedService for PrfSetServer<T> {
-        const NAME: &'static str = "tink_testing_api.PrfSet";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.PrfSet";
+    impl<T> tonic::server::NamedService for PrfSetServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
 /// Generated server implementations.
 pub mod jwt_server {
-    #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
+    #![allow(
+        unused_variables,
+        dead_code,
+        missing_docs,
+        clippy::wildcard_imports,
+        clippy::let_unit_value,
+    )]
     use tonic::codegen::*;
     /// Generated trait containing gRPC methods that should be implemented for use with JwtServer.
     #[async_trait]
-    pub trait Jwt: Send + Sync + 'static {
+    pub trait Jwt: std::marker::Send + std::marker::Sync + 'static {
         /// Computes a signed compact JWT token.
         async fn compute_mac_and_encode(
             &self,
             request: tonic::Request<super::JwtSignRequest>,
-        ) -> Result<tonic::Response<super::JwtSignResponse>, tonic::Status>;
+        ) -> std::result::Result<tonic::Response<super::JwtSignResponse>, tonic::Status>;
         /// Verifies the validity of the signed compact JWT token
         async fn verify_mac_and_decode(
             &self,
             request: tonic::Request<super::JwtVerifyRequest>,
-        ) -> Result<tonic::Response<super::JwtVerifyResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::JwtVerifyResponse>,
+            tonic::Status,
+        >;
         /// Computes a signed compact JWT token.
         async fn public_key_sign_and_encode(
             &self,
             request: tonic::Request<super::JwtSignRequest>,
-        ) -> Result<tonic::Response<super::JwtSignResponse>, tonic::Status>;
+        ) -> std::result::Result<tonic::Response<super::JwtSignResponse>, tonic::Status>;
         /// Verifies the validity of the signed compact JWT token
         async fn public_key_verify_and_decode(
             &self,
             request: tonic::Request<super::JwtVerifyRequest>,
-        ) -> Result<tonic::Response<super::JwtVerifyResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::JwtVerifyResponse>,
+            tonic::Status,
+        >;
         /// Converts a Keyset from Tink Binary to JWK Set Format
         async fn to_jwk_set(
             &self,
             request: tonic::Request<super::JwtToJwkSetRequest>,
-        ) -> Result<tonic::Response<super::JwtToJwkSetResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::JwtToJwkSetResponse>,
+            tonic::Status,
+        >;
         /// Converts a Keyset from JWK Set to Tink Binary Format
         async fn from_jwk_set(
             &self,
             request: tonic::Request<super::JwtFromJwkSetRequest>,
-        ) -> Result<tonic::Response<super::JwtFromJwkSetResponse>, tonic::Status>;
+        ) -> std::result::Result<
+            tonic::Response<super::JwtFromJwkSetResponse>,
+            tonic::Status,
+        >;
     }
     /// Service for JSON Web Tokens (JWT)
     #[derive(Debug)]
-    pub struct JwtServer<T: Jwt> {
-        inner: _Inner<T>,
+    pub struct JwtServer<T> {
+        inner: Arc<T>,
         accept_compression_encodings: EnabledCompressionEncodings,
         send_compression_encodings: EnabledCompressionEncodings,
+        max_decoding_message_size: Option<usize>,
+        max_encoding_message_size: Option<usize>,
     }
-    struct _Inner<T>(Arc<T>);
-    impl<T: Jwt> JwtServer<T> {
+    impl<T> JwtServer<T> {
         pub fn new(inner: T) -> Self {
             Self::from_arc(Arc::new(inner))
         }
         pub fn from_arc(inner: Arc<T>) -> Self {
-            let inner = _Inner(inner);
             Self {
                 inner,
                 accept_compression_encodings: Default::default(),
                 send_compression_encodings: Default::default(),
+                max_decoding_message_size: None,
+                max_encoding_message_size: None,
             }
         }
         pub fn with_interceptor<F>(
@@ -3915,12 +4602,28 @@ pub mod jwt_server {
             self.send_compression_encodings.enable(encoding);
             self
         }
+        /// Limits the maximum size of a decoded message.
+        ///
+        /// Default: `4MB`
+        #[must_use]
+        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
+            self.max_decoding_message_size = Some(limit);
+            self
+        }
+        /// Limits the maximum size of an encoded message.
+        ///
+        /// Default: `usize::MAX`
+        #[must_use]
+        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
+            self.max_encoding_message_size = Some(limit);
+            self
+        }
     }
     impl<T, B> tonic::codegen::Service<http::Request<B>> for JwtServer<T>
     where
         T: Jwt,
-        B: Body + Send + 'static,
-        B::Error: Into<StdError> + Send + 'static,
+        B: Body + std::marker::Send + 'static,
+        B::Error: Into<StdError> + std::marker::Send + 'static,
     {
         type Response = http::Response<tonic::body::BoxBody>;
         type Error = std::convert::Infallible;
@@ -3928,11 +4631,10 @@ pub mod jwt_server {
         fn poll_ready(
             &mut self,
             _cx: &mut Context<'_>,
-        ) -> Poll<Result<(), Self::Error>> {
+        ) -> Poll<std::result::Result<(), Self::Error>> {
             Poll::Ready(Ok(()))
         }
         fn call(&mut self, req: http::Request<B>) -> Self::Future {
-            let inner = self.inner.clone();
             match req.uri().path() {
                 "/tink_testing_api.Jwt/ComputeMacAndEncode" => {
                     #[allow(non_camel_case_types)]
@@ -3948,24 +4650,29 @@ pub mod jwt_server {
                             &mut self,
                             request: tonic::Request<super::JwtSignRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).compute_mac_and_encode(request).await
+                                <T as Jwt>::compute_mac_and_encode(&inner, request).await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = ComputeMacAndEncodeSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -3986,24 +4693,29 @@ pub mod jwt_server {
                             &mut self,
                             request: tonic::Request<super::JwtVerifyRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).verify_mac_and_decode(request).await
+                                <T as Jwt>::verify_mac_and_decode(&inner, request).await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = VerifyMacAndDecodeSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -4024,24 +4736,30 @@ pub mod jwt_server {
                             &mut self,
                             request: tonic::Request<super::JwtSignRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).public_key_sign_and_encode(request).await
+                                <T as Jwt>::public_key_sign_and_encode(&inner, request)
+                                    .await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = PublicKeySignAndEncodeSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -4062,24 +4780,30 @@ pub mod jwt_server {
                             &mut self,
                             request: tonic::Request<super::JwtVerifyRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).public_key_verify_and_decode(request).await
+                                <T as Jwt>::public_key_verify_and_decode(&inner, request)
+                                    .await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = PublicKeyVerifyAndDecodeSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -4100,22 +4824,29 @@ pub mod jwt_server {
                             &mut self,
                             request: tonic::Request<super::JwtToJwkSetRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
-                            let fut = async move { (*inner).to_jwk_set(request).await };
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as Jwt>::to_jwk_set(&inner, request).await
+                            };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = ToJwkSetSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -4136,24 +4867,29 @@ pub mod jwt_server {
                             &mut self,
                             request: tonic::Request<super::JwtFromJwkSetRequest>,
                         ) -> Self::Future {
-                            let inner = self.0.clone();
+                            let inner = Arc::clone(&self.0);
                             let fut = async move {
-                                (*inner).from_jwk_set(request).await
+                                <T as Jwt>::from_jwk_set(&inner, request).await
                             };
                             Box::pin(fut)
                         }
                     }
                     let accept_compression_encodings = self.accept_compression_encodings;
                     let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
                     let inner = self.inner.clone();
                     let fut = async move {
-                        let inner = inner.0;
                         let method = FromJwkSetSvc(inner);
                         let codec = tonic::codec::ProstCodec::default();
                         let mut grpc = tonic::server::Grpc::new(codec)
                             .apply_compression_config(
                                 accept_compression_encodings,
                                 send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
                             );
                         let res = grpc.unary(method, req).await;
                         Ok(res)
@@ -4162,40 +4898,39 @@ pub mod jwt_server {
                 }
                 _ => {
                     Box::pin(async move {
-                        Ok(
-                            http::Response::builder()
-                                .status(200)
-                                .header("grpc-status", "12")
-                                .header("content-type", "application/grpc")
-                                .body(empty_body())
-                                .unwrap(),
-                        )
+                        let mut response = http::Response::new(empty_body());
+                        let headers = response.headers_mut();
+                        headers
+                            .insert(
+                                tonic::Status::GRPC_STATUS,
+                                (tonic::Code::Unimplemented as i32).into(),
+                            );
+                        headers
+                            .insert(
+                                http::header::CONTENT_TYPE,
+                                tonic::metadata::GRPC_CONTENT_TYPE,
+                            );
+                        Ok(response)
                     })
                 }
             }
         }
     }
-    impl<T: Jwt> Clone for JwtServer<T> {
+    impl<T> Clone for JwtServer<T> {
         fn clone(&self) -> Self {
             let inner = self.inner.clone();
             Self {
                 inner,
                 accept_compression_encodings: self.accept_compression_encodings,
                 send_compression_encodings: self.send_compression_encodings,
+                max_decoding_message_size: self.max_decoding_message_size,
+                max_encoding_message_size: self.max_encoding_message_size,
             }
         }
     }
-    impl<T: Jwt> Clone for _Inner<T> {
-        fn clone(&self) -> Self {
-            Self(self.0.clone())
-        }
-    }
-    impl<T: std::fmt::Debug> std::fmt::Debug for _Inner<T> {
-        fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-            write!(f, "{:?}", self.0)
-        }
-    }
-    impl<T: Jwt> tonic::server::NamedService for JwtServer<T> {
-        const NAME: &'static str = "tink_testing_api.Jwt";
+    /// Generated gRPC service name
+    pub const SERVICE_NAME: &str = "tink_testing_api.Jwt";
+    impl<T> tonic::server::NamedService for JwtServer<T> {
+        const NAME: &'static str = SERVICE_NAME;
     }
 }
diff --git a/tests/Cargo.toml b/tests/Cargo.toml
index cb6d8af56..5e294e3b1 100644
--- a/tests/Cargo.toml
+++ b/tests/Cargo.toml
@@ -11,7 +11,7 @@ categories = ["cryptography"]
 publish = false
 
 [dependencies]
-base64 = "^0.21"
+base64 = "^0.22"
 ed25519-dalek = { version = "2.1.1", features = ["rand_core"] }
 generic-array = "^0.14.7"
 hex = "^0.4.3"
@@ -28,7 +28,7 @@ tink-mac = "^0.2"
 tink-proto = "^0.2"
 
 [dev-dependencies]
-base64 = "^0.21"
+base64 = "^0.22"
 hex = "^0.4.3"
 lazy_static = "^1.5"
 maplit = "^1.0.2"
diff --git a/tests/src/lib.rs b/tests/src/lib.rs
index fe3d71b9e..f1f6ad67b 100644
--- a/tests/src/lib.rs
+++ b/tests/src/lib.rs
@@ -21,7 +21,7 @@
 use generic_array::typenum::Unsigned;
 use p256::elliptic_curve;
 use serde::{Deserialize, Serialize};
-use std::convert::TryInto;
+use std::convert::{TryFrom, TryInto};
 use tink_core::{subtle::random::get_random_bytes, utils::wrap_err, Aead, TinkError};
 use tink_proto::{prost, EcdsaSignatureEncoding, EllipticCurveType, HashType, KeyData, Keyset};
 
@@ -314,7 +314,7 @@ pub fn new_ecdsa_params(
 /// Create an [`EcdsaKeyFormat`](tink_proto::EcdsaKeyFormat) with the specified parameters.
 pub fn new_ecdsa_key_format(params: &tink_proto::EcdsaParams) -> tink_proto::EcdsaKeyFormat {
     tink_proto::EcdsaKeyFormat {
-        params: Some(params.clone()),
+        params: Some(*params),
     }
 }
 
@@ -385,9 +385,9 @@ pub fn get_ecdsa_params(
     params: &tink_proto::EcdsaParams,
 ) -> (HashType, EllipticCurveType, EcdsaSignatureEncoding) {
     (
-        HashType::from_i32(params.hash_type).unwrap(),
-        EllipticCurveType::from_i32(params.curve).unwrap(),
-        EcdsaSignatureEncoding::from_i32(params.encoding).unwrap(),
+        HashType::try_from(params.hash_type).unwrap(),
+        EllipticCurveType::try_from(params.curve).unwrap(),
+        EcdsaSignatureEncoding::try_from(params.encoding).unwrap(),
     )
 }
 
diff --git a/tests/tests/core/primitiveset/mod.rs b/tests/tests/core/primitiveset/mod.rs
index 154b01efb..ded4b7437 100644
--- a/tests/tests/core/primitiveset/mod.rs
+++ b/tests/tests/core/primitiveset/mod.rs
@@ -14,6 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
+use std::convert::TryFrom;
 use tink_core::{primitiveset::Entry, Primitive};
 use tink_proto::{keyset::Key, KeyStatusType, OutputPrefixType};
 use tink_tests::{new_dummy_key, DummyMac};
@@ -61,12 +62,12 @@ fn test_primitive_set_basic() {
     let raw_ids = vec![keys[3].key_id, keys[4].key_id];
     let raw_macs = vec![macs[3].clone(), macs[4].clone()];
     let raw_statuses = vec![
-        KeyStatusType::from_i32(keys[3].status).unwrap(),
-        KeyStatusType::from_i32(keys[4].status).unwrap(),
+        KeyStatusType::try_from(keys[3].status).unwrap(),
+        KeyStatusType::try_from(keys[4].status).unwrap(),
     ];
     let raw_prefix_types = vec![
-        OutputPrefixType::from_i32(keys[3].output_prefix_type).unwrap(),
-        OutputPrefixType::from_i32(keys[4].output_prefix_type).unwrap(),
+        OutputPrefixType::try_from(keys[3].output_prefix_type).unwrap(),
+        OutputPrefixType::try_from(keys[4].output_prefix_type).unwrap(),
     ];
     let raw_entries = ps.raw_entries();
     assert!(
@@ -84,12 +85,12 @@ fn test_primitive_set_basic() {
     let tink_ids = vec![keys[0].key_id, keys[5].key_id];
     let tink_macs = vec![macs[0].clone(), macs[5].clone()];
     let tink_statuses = vec![
-        KeyStatusType::from_i32(keys[0].status).unwrap(),
-        KeyStatusType::from_i32(keys[5].status).unwrap(),
+        KeyStatusType::try_from(keys[0].status).unwrap(),
+        KeyStatusType::try_from(keys[5].status).unwrap(),
     ];
     let tink_prefix_types = vec![
-        OutputPrefixType::from_i32(keys[0].output_prefix_type).unwrap(),
-        OutputPrefixType::from_i32(keys[5].output_prefix_type).unwrap(),
+        OutputPrefixType::try_from(keys[0].output_prefix_type).unwrap(),
+        OutputPrefixType::try_from(keys[5].output_prefix_type).unwrap(),
     ];
     let prefix = tink_core::cryptofmt::output_prefix(&keys[0]).unwrap();
     let tink_entries = ps.entries_for_prefix(&prefix);
@@ -107,8 +108,8 @@ fn test_primitive_set_basic() {
     // check another tink primitive
     let tink_ids = vec![keys[2].key_id];
     let tink_macs = vec![macs[2].clone()];
-    let tink_statuses = vec![KeyStatusType::from_i32(keys[2].status).unwrap()];
-    let tink_prefix_types = vec![OutputPrefixType::from_i32(keys[2].output_prefix_type).unwrap()];
+    let tink_statuses = vec![KeyStatusType::try_from(keys[2].status).unwrap()];
+    let tink_prefix_types = vec![OutputPrefixType::try_from(keys[2].output_prefix_type).unwrap()];
     let prefix = tink_core::cryptofmt::output_prefix(&keys[2]).unwrap();
     let tink_entries = ps.entries_for_prefix(&prefix);
     assert!(
@@ -125,8 +126,8 @@ fn test_primitive_set_basic() {
     // check legacy primitives
     let legacy_ids = vec![keys[1].key_id];
     let legacy_macs = vec![macs[1].clone()];
-    let legacy_statuses = vec![KeyStatusType::from_i32(keys[1].status).unwrap()];
-    let legacy_prefix_types = vec![OutputPrefixType::from_i32(keys[1].output_prefix_type).unwrap()];
+    let legacy_statuses = vec![KeyStatusType::try_from(keys[1].status).unwrap()];
+    let legacy_prefix_types = vec![OutputPrefixType::try_from(keys[1].output_prefix_type).unwrap()];
     let legacy_prefix = tink_core::cryptofmt::output_prefix(&keys[1]).unwrap();
     let legacy_entries = ps.entries_for_prefix(&legacy_prefix);
     assert!(
diff --git a/tests/tests/mac/hmac_key_manager_test.rs b/tests/tests/mac/hmac_key_manager_test.rs
index f0d4ecbb9..1540bbf63 100644
--- a/tests/tests/mac/hmac_key_manager_test.rs
+++ b/tests/tests/mac/hmac_key_manager_test.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-use std::collections::HashSet;
+use std::{collections::HashSet, convert::TryFrom};
 use tink_core::{utils::wrap_err, Mac, TinkError};
 use tink_proto::{prost::Message, HashType};
 use tink_tests::proto_encode;
@@ -262,7 +262,7 @@ fn validate_hmac_key(
         return Err("key format and generated key do not match".into());
     }
     let p = tink_mac::subtle::Hmac::new(
-        HashType::from_i32(key.params.as_ref().unwrap().hash).unwrap(),
+        HashType::try_from(key.params.as_ref().unwrap().hash).unwrap(),
         &key.key_value,
         key.params.as_ref().unwrap().tag_size as usize,
     )
@@ -280,7 +280,7 @@ fn validate_hmac_primitive(
         _ => return Err("not a Mac primitive".into()),
     };
     let key_primitive = tink_mac::subtle::Hmac::new(
-        HashType::from_i32(key.params.as_ref().unwrap().hash).unwrap(),
+        HashType::try_from(key.params.as_ref().unwrap().hash).unwrap(),
         &key.key_value,
         key.params.as_ref().unwrap().tag_size as usize,
     )
diff --git a/tests/tests/prf/hkdf_prf_key_manager_test.rs b/tests/tests/prf/hkdf_prf_key_manager_test.rs
index 5a0cbb551..5d0470902 100644
--- a/tests/tests/prf/hkdf_prf_key_manager_test.rs
+++ b/tests/tests/prf/hkdf_prf_key_manager_test.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-use std::collections::HashSet;
+use std::{collections::HashSet, convert::TryFrom};
 use tink_core::{utils::wrap_err, Prf, TinkError};
 use tink_proto::{prost::Message, HashType};
 use tink_tests::proto_encode;
@@ -263,7 +263,7 @@ fn validate_hkdf_key(
         return Err("key format and generated key do not match".into());
     }
     let p = tink_prf::subtle::HkdfPrf::new(
-        HashType::from_i32(key.params.as_ref().unwrap().hash).unwrap(),
+        HashType::try_from(key.params.as_ref().unwrap().hash).unwrap(),
         &key.key_value,
         &key.params.as_ref().unwrap().salt,
     )
@@ -280,7 +280,7 @@ fn validate_hkdf_primitive(
         tink_core::Primitive::Prf(prf) => prf,
         _ => return Err("not a Prf primitive".into()),
     };
-    let hash = HashType::from_i32(key.params.as_ref().unwrap().hash).unwrap();
+    let hash = HashType::try_from(key.params.as_ref().unwrap().hash).unwrap();
     let prf_primitive =
         tink_prf::subtle::HkdfPrf::new(hash, &key.key_value, &key.params.as_ref().unwrap().salt)
             .map_err(|e| {
diff --git a/tests/tests/prf/hmac_prf_key_manager_test.rs b/tests/tests/prf/hmac_prf_key_manager_test.rs
index fd4f05f15..5703dee7c 100644
--- a/tests/tests/prf/hmac_prf_key_manager_test.rs
+++ b/tests/tests/prf/hmac_prf_key_manager_test.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-use std::collections::HashSet;
+use std::{collections::HashSet, convert::TryFrom};
 use tink_core::{utils::wrap_err, Prf, TinkError};
 use tink_proto::{prost::Message, HashType};
 use tink_tests::proto_encode;
@@ -258,7 +258,7 @@ fn validate_hmac_prf_key(
         return Err("key format and generated key do not match".into());
     }
     let p = tink_prf::subtle::HmacPrf::new(
-        HashType::from_i32(key.params.as_ref().unwrap().hash).unwrap(),
+        HashType::try_from(key.params.as_ref().unwrap().hash).unwrap(),
         &key.key_value,
     )
     .map_err(|e| wrap_err("cannot create primitive from key", e))?;
@@ -274,7 +274,7 @@ fn validate_hmac_prf_primitive(
         tink_core::Primitive::Prf(prf) => prf,
         _ => return Err("not a Prf primitive".into()),
     };
-    let hash = HashType::from_i32(key.params.as_ref().unwrap().hash).unwrap();
+    let hash = HashType::try_from(key.params.as_ref().unwrap().hash).unwrap();
     let prf_primitive = tink_prf::subtle::HmacPrf::new(hash, &key.key_value).map_err(|e| {
         wrap_err(
             &format!(
diff --git a/tests/tests/signature/ecdsa_signer_key_manager_test.rs b/tests/tests/signature/ecdsa_signer_key_manager_test.rs
index 936243c53..387bf7ab6 100644
--- a/tests/tests/signature/ecdsa_signer_key_manager_test.rs
+++ b/tests/tests/signature/ecdsa_signer_key_manager_test.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-use std::collections::HashSet;
+use std::{collections::HashSet, convert::TryFrom};
 use tink_core::{subtle::random::get_random_bytes, Signer, TinkError, Verifier};
 use tink_proto::{
     prost::Message, EcdsaKeyFormat, EcdsaParams, EcdsaPrivateKey, EcdsaPublicKey,
@@ -373,18 +373,18 @@ fn validate_ecdsa_private_key(
     }
     // check private key's size
     let key_size = key.key_value.len();
-    match EllipticCurveType::from_i32(params.curve) {
-        Some(EllipticCurveType::NistP256) => {
+    match EllipticCurveType::try_from(params.curve) {
+        Ok(EllipticCurveType::NistP256) => {
             if !(256 / 8 - 8..=256 / 8 + 1).contains(&key_size) {
                 return Err("private key doesn't have adequate size".into());
             }
         }
-        Some(EllipticCurveType::NistP384) => {
+        Ok(EllipticCurveType::NistP384) => {
             if !(384 / 8 - 8..=384 / 8 + 1).contains(&key_size) {
                 return Err("private key doesn't have adequate size".into());
             }
         }
-        Some(EllipticCurveType::NistP521) => {
+        Ok(EllipticCurveType::NistP521) => {
             if !(521 / 8 - 8..=521 / 8 + 1).contains(&key_size) {
                 return Err("private key doesn't have adequate size".into());
             }
diff --git a/tests/tests/streaming/aes_ctr_hmac_key_manager_test.rs b/tests/tests/streaming/aes_ctr_hmac_key_manager_test.rs
index 8621f9365..f466f081c 100644
--- a/tests/tests/streaming/aes_ctr_hmac_key_manager_test.rs
+++ b/tests/tests/streaming/aes_ctr_hmac_key_manager_test.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-use std::collections::HashSet;
+use std::{collections::HashSet, convert::TryFrom};
 use tink_core::TinkError;
 use tink_proto::{
     prost::Message, AesCtrHmacStreamingKey, AesCtrHmacStreamingKeyFormat,
@@ -342,14 +342,14 @@ fn validate_aes_ctr_hmac_key(
     if key_params.hkdf_hash_type != format_params.hkdf_hash_type {
         return Err("incorrect HKDF hash type".into());
     }
-    let hkdf_hash_type = HashType::from_i32(key_params.hkdf_hash_type)
-        .ok_or_else(|| TinkError::new("invalid HKDF hash"))?;
+    let hkdf_hash_type = HashType::try_from(key_params.hkdf_hash_type)
+        .map_err(|_e| TinkError::new("invalid HKDF hash"))?;
     let hmac_params = key_params
         .hmac_params
         .as_ref()
         .ok_or_else(|| TinkError::new("no params"))?;
     let hmac_hash =
-        HashType::from_i32(hmac_params.hash).ok_or_else(|| TinkError::new("invalid HMAC hash"))?;
+        HashType::try_from(hmac_params.hash).map_err(|_e| TinkError::new("invalid HMAC hash"))?;
     // try to encrypt and decrypt
     let p = subtle::AesCtrHmac::new(
         &key.key_value,
@@ -885,9 +885,9 @@ fn test_aes_ctr_hmac_new_with_invalid_params() {
         let hmac_params = params.hmac_params.as_ref().unwrap();
         let result = subtle::AesCtrHmac::new(
             &key.key_value,
-            HashType::from_i32(params.hkdf_hash_type).unwrap(),
+            HashType::try_from(params.hkdf_hash_type).unwrap(),
             params.derived_key_size as usize,
-            HashType::from_i32(hmac_params.hash).unwrap(),
+            HashType::try_from(hmac_params.hash).unwrap(),
             hmac_params.tag_size as usize,
             params.ciphertext_segment_size as usize,
             0,
diff --git a/tests/tests/streaming/aes_gcm_hkdf_key_manager_test.rs b/tests/tests/streaming/aes_gcm_hkdf_key_manager_test.rs
index 51c3e3c05..7c622ceaa 100644
--- a/tests/tests/streaming/aes_gcm_hkdf_key_manager_test.rs
+++ b/tests/tests/streaming/aes_gcm_hkdf_key_manager_test.rs
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-use std::collections::HashSet;
+use std::{collections::HashSet, convert::TryFrom};
 use tink_core::TinkError;
 use tink_proto::{prost::Message, HashType};
 use tink_streaming_aead::subtle;
@@ -352,8 +352,8 @@ fn validate_aes_gcm_hkdf_key(
         return Err("incorrect HKDF hash type".into());
     }
     // try to encrypt and decrypt
-    let hkdf_hash_type = HashType::from_i32(key_params.hkdf_hash_type)
-        .ok_or_else(|| TinkError::new("invalid HKDF hash"))?;
+    let hkdf_hash_type = HashType::try_from(key_params.hkdf_hash_type)
+        .map_err(|_e| TinkError::new("invalid HKDF hash"))?;
     let p = subtle::AesGcmHkdf::new(
         &key.key_value,
         hkdf_hash_type,