anchor.diff:      catch
           throw:Why -> {no_authn, Why}
       end.
  +
  +-spec do_authenticate_user_request(get_header_fun(), 
  +				   http_method(),
  +				   http_path(),
  +				   http_body(),
  +				   raw_public_key() ) 
  +				  ->  {name, user_id()} | {no_authn, bad_sig}.
   
   do_authenticate_user_request(GetHeader, Method, Path, Body, PublicKey) ->
       % NOTE: signing description validation and time_skew validation
  
positive.code: -type sha_hash64() :: binary().
  -type erlang_time() :: {calendar_date(), calendar_time()}.
  -type private_key() :: binary().
  -type header_name() :: binary().
  -type header_value() :: binary() | 'undefined'.
  -type header_fun() :: fun((header_name()) -> header_value()).
  -type time_skew() :: non_neg_integer().
  
  -ifdef(TEST).
  -include_lib("eunit/include/eunit.hrl").
  
negative.code:         error:{badmatch, _} -> {no_authn, bad_sig}
      end.
  
  -spec decrypt_sig(binary(), raw_public_key()) -> binary() | decrypt_failed.
  decrypt_sig(Sig, PublicCert) ->
      PK = read_cert(PublicCert),
      try
  