def METHOD_NAME(self, sign_kwargs, expected_flag):
    class FakeAgent:
        def _send_message(self, msg):
            # The thing we actually care most about, we're not testing
            # ssh-agent itself here
            self._sent_message = msg
            sig = Message()
            sig.add_string("lol")
            sig.rewind()
            return SSH2_AGENT_SIGN_RESPONSE, sig
    for do_cert in (False, True):
        agent = FakeAgent()
        # Get key kinda like how a real agent would give it to us - if
        # cert, it'd be the entire public blob, not just the pubkey. This
        # ensures the code under test sends _just the pubkey part_ back to
        # the agent during signature requests (bug was us sending _the
        # entire cert blob_, which somehow "worked ok" but always got us
        # SHA1)
        # NOTE: using lower level loader to avoid auto-cert-load when
        # testing regular key (agents expose them separately)
        inner_key = RSAKey.from_private_key_file(_support("rsa.key"))
        blobby = inner_key.asbytes()
        # NOTE: expected key blob always wants to be the real key, even
        # when the "key" is a certificate.
        expected_request_key_blob = blobby
        if do_cert:
            inner_key.load_certificate(_support("rsa.key-cert.pub"))
            blobby = inner_key.public_blob.key_blob
        key = AgentKey(agent, blobby)
        result = key.sign_ssh_data(b"data-to-sign", **sign_kwargs)
        assert result == b"lol"
        msg = agent._sent_message
        msg.rewind()
        assert msg.get_byte() == cSSH2_AGENTC_SIGN_REQUEST
        assert msg.get_string() == expected_request_key_blob
        assert msg.get_string() == b"data-to-sign"
        assert msg.get_int() == expected_flag