anchor.diff:          {ok, Pem} ->
               try
                   decode_ssh_file(PrivPub, Algorithm, Pem, Password)
  +            of
  +                {ok, [Key|_Keys]} ->
  +                    {ok,Key};
  +                {error, Reason} ->
  +                    {error, Reason}
               catch
                   throw:Reason ->
                       {error, Reason};
  
positive.code:     end.
  
  
  decode_ssh_file(PrivPub, Algorithm, Pem, Password) ->
      %% Private Key
      try get_key_part(Pem) of
          {'openssh-key-v1', Bin, _KeyValues} ->
              %% Holds both public and private keys
              KeyPairs = new_openssh_decode(Bin, Password),
              ValidKeys =
                  [Key || {Pub,Priv} <- KeyPairs,
                          Key <- [Pub,Priv],
                          ssh_transport:valid_key_sha_alg(PrivPub, Key, Algorithm)],
              %% Select one (for now, just pick the first found):
              case ValidKeys of
                  [Key|_] -> {ok,Key};
                  [] -> {error,bad_keytype_in_file}
              end;
  
          {rfc4716, Bin, _KeyValues} ->
              %% rfc4716 only defines public keys
              Key = ssh_message:ssh2_pubkey_decode(Bin),
              case ssh_transport:valid_key_sha_alg(PrivPub, Key, Algorithm) of
                  true -> {ok,Key};
                  false -> {error,bad_keytype_in_file}
              end;
  
          {Type, Bin, KeyValues} ->
              Key =
                  case get_encrypt_hdrs(KeyValues) of
                      not_encrypted ->
                          public_key:pem_entry_decode({Type,Bin,not_encrypted});
                      [Cipher,Salt] when is_binary(Cipher),
                                         is_binary(Salt),
                                         Password =/= ignore ->
                          CryptInfo =
                              {binary_to_list(Cipher), unhex(binary_to_list(Salt))},
                          public_key:pem_entry_decode({Type,Bin,CryptInfo}, Password);
                      _X ->
                          throw("No pass phrase provided for private key file")
                  end,
              case ssh_transport:valid_key_sha_alg(PrivPub, Key, Algorithm) of
                  true -> {ok,Key};
                  false -> {error,bad_keytype_in_file}
              end
      catch
          _:_ -> error(bad_or_unsupported_key_format)
  
negative.code: -include_lib("kernel/include/file.hrl").
  
  -include("ssh.hrl").
  
  %% experimental:
  -export([decode_ssh_file/4]).
  
  %%%--------------------- server exports ---------------------------
  -behaviour(ssh_server_key_api).
  