anchor.diff:              Sig
       end.
   
  +
  
positive.code: 
  -define(JWT_ALG, <<"ES256">>).
  -define(JWT_TYP, <<"JWT">>).
  -define(DIGEST_TYPE, sha256).
  -define(MAX_IAT_AGE_SECS, 60*60). % APNS gives it an hour
  
  -define(IS_SIGNING_KEY(SigningKey),
          (is_binary(SigningKey) orelse is_record(SigningKey, 'ECPrivateKey'))).
  
  %%%-------------------------------------------------------------------
  %%% Types
  %%%-------------------------------------------------------------------
  -type bstring() :: binary().
  
negative.code: -spec get_private_key(SigningKeyPem) -> PrivateKey when
        SigningKeyPem :: pem_encoded_key(), PrivateKey :: ec_private_key().
  get_private_key(SigningKeyPem) ->
      ExpType = 'PrivateKeyInfo',
      case public_key:pem_decode(SigningKeyPem) of
          [{ExpType, DER, _}] ->
              #'PrivateKeyInfo'{}=PKI = public_key:der_decode(ExpType, DER),
              %% So this isn't the end of it - the privateKey component of
              %% 'PrivateKeyInfo' is just an OCTET-STRING that needs to be
              %% further decoded as an ECPrivateKey.
              PrivKeyOctets = PKI#'PrivateKeyInfo'.privateKey,
              %% -record('ECPrivateKey', {version, privateKey, parameters,
              %%                          publicKey}).
              {ok, ECPK} = 'OTP-PUB-KEY':decode('ECPrivateKey', PrivKeyOctets),
              ECPK;
          [{UnexpType, _, _}] ->
              throw({unexpected_signing_key_type, UnexpType})
      end.
  
  %%--------------------------------------------------------------------
  %% @doc Generate a private key. This is mostly useful for testing.
  