anchor.diff:  -spec verify_provider(PeerCertDer :: public_key:der_encoded()) ->
       {ok, ProviderId :: binary()} | {error, {bad_cert, Reason :: atom()}}.
   %% ====================================================================
  -verify_provider(PeerCertDer) -> %% @todo: CRLs
  +verify_provider(PeerCertDer) ->
       case delegate(verify_provider, {PeerCertDer}) of
           {ok, ProviderId} = Result when is_binary(ProviderId) -> Result;
           {error, {bad_cert, Reason}} = Result when is_atom(Reason) -> Result
  
positive.code:     after 60000 ->
          ?MODULE:loop(CaDir)
      end.
  
  
  %% get_provider_id/1
  
negative.code: -spec verify_provider_imp(PeerCertDer :: public_key:der_encoded(),
      CaDir :: string()) -> {ok, ProviderId :: binary()}.
  %% ====================================================================
  verify_provider_imp(PeerCertDer, CaDir) ->
      CaCertFile = cacert_path(CaDir),
      {ok, CaCertPem} = file:read_file(CaCertFile),
      [{'Certificate', CaCertDer, not_encrypted}] = public_key:pem_decode(CaCertPem),
  