Required in policies. It's in `cloudkms.CryptoKey` but not in `pb.CryptoKey`
Required in policies. It's in
cloudkms.CryptoKeybut not inpb.CryptoKey