anchor.diff:      ObjectId;
   maybe_stub_authz_id(AuthzId, _ObjectId) ->
       AuthzId.
  +
  +cert_or_key(ClientData) ->
  +    Cert = ej:get({<<"certificate">>}, ClientData),
  +    PublicKey = ej:get({<<"public_key">>}, ClientData),
  +    %% Take certificate first, then public_key
  +    case Cert of
  +        undefined ->
  +            {PublicKey, ?KEY_VERSION};
  +        _ ->
  +            {Cert, ?CERT_VERSION}
  +    end.
  
positive.code:     Env#chef_environment{name = Name, serialized_object = Data};
  update_from_ejson(#chef_client{} = Client, ClientData, _DbType) ->
      Name = ej:get({<<"name">>}, ClientData),
      PublicKey = ej:get({<<"certificate">>}, ClientData),
      Client#chef_client{name = Name, public_key = PublicKey, pubkey_version = 1};
  update_from_ejson(#chef_data_bag{} = DataBag, DataBagData, _DbType) ->
      %% here for completeness
      Name = ej:get({<<"name">>}, DataBagData),
  
negative.code: new_record(chef_client, OrgId, AuthzId, ClientData, _DbType) ->
      Name = ej:get({<<"name">>}, ClientData),
      Id = make_org_prefix_id(OrgId, Name),
      Validator = ej:get({<<"validator">>}, ClientData) =:= true,
      Admin = ej:get({<<"admin">>}, ClientData) =:= true,
      {PublicKey, PubkeyVersion} = cert_or_key(ClientData),
      #chef_client{id = Id,
                   authz_id = maybe_stub_authz_id(AuthzId, Id),
                   org_id = OrgId,
  