anchor.diff:          error:{badmatch, _} -> {no_authn, bad_sig}
       end.
   
  --spec decrypt_sig(binary(), binary()) -> binary() | decrypt_failed.
  +-spec decrypt_sig(binary(), raw_public_key()) -> binary() | decrypt_failed.
   decrypt_sig(Sig, PublicCert) ->
       PK = read_cert(PublicCert),
       try
  
positive.code: -type calendar_time() :: { non_neg_integer(),  non_neg_integer(),  non_neg_integer() }.
  -type calendar_date() :: { integer(),  1..12, 1..31 }.
  
  -type http_body() :: binary() | pid().
  -type user_id() :: binary().
  -type http_method() :: binary().
  
negative.code: %%
  %% `PublicKey' is a binary containing an RSA public key in PEM format.
  %%
  -spec authenticate_user_request(get_header_fun(),
                                     http_method(),
                                     http_path(),
                                     http_body(),
  				   raw_public_key(),
                                     time_skew()) ->
  				       {name, user_id()} | {no_authn, Reason::term()}.
  authenticate_user_request(GetHeader, Method, Path, Body, PublicKey, TimeSkew) ->
      try
          validate_headers(GetHeader, TimeSkew),
  