There are some Serializable classes, which extends from RawKey, which is not Serializable.

• RawRSAPrivateKey
• RawDHPrivateKey
• RawPBEKey
• RawECPrivateKey
• RawDSAPrivateKey

Either mark RawKey as Serializable as well or if this is not desired, provide no-args constructor in RawKey class, as javadoc describes:

During deserialization, the fields of non-serializable classes will be initialized using the public or protected no-arg constructor of the class. A no-arg constructor must be accessible to the subclass that is serializable. The fields of serializable subclasses will be restored from the stream. [1]

[1] http://docs.oracle.com/javase/8/docs/api/java/io/Serializable.html

https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=8553919&defectInstanceId=2138989&mergedDefectId=1377488