anchor.diff:  
      $ ssh-add -s $OPENSC_LIBS/opensc-pkcs11.so
   +
  -NOTE: On OS X this typically requires installation of a third-party OpenSSH from Homebrew or the like and using that ssh-agent.
  +NOTE: On OS X prior to macOS 10.12 “Sierra” this typically requires installation of a third-party OpenSSH from Homebrew or the like and using that ssh-agent.
   +
  -To See that the ssh-agent correctly finds that key and getting the public key in correct format:
  +To confirm that the ssh-agent correctly finds that key and getting the public key in correct format:
   
      $ ssh-add -L
  
positive.code: 
  4. Find out where OpenSC has installed the pkcs11 module.
  
    * For OS X with binary installation this is typically in `/Library/OpenSC/lib/`
  
    * For a Debian based system this is typically in `/usr/lib/x86_64-linux-gnu/`
  +
  
negative.code: 
  1. Generate a key in slot 9a (any slot should suffice):
  
    $ yubico-piv-tool -s 9a -a generate -o public.pem 
  
  [NOTE]
  RSA 4096-bit keys are not currently supported due to a limitation in the PIV spec: https://github.com/Yubico/yubico-piv-tool/issues/58
  
  2. Create a self-signed certificate for that key.
  The only use for the X.509 certificate is to make PIV/PKCS#11 lib happy.
  They would want to be able to extract the public-key from the smartcard,
  and do that through the X.509 certificate.
  
    $ yubico-piv-tool -a verify-pin -a selfsign-certificate -s 9a -S "/CN=SSH key/" -i public.pem -o cert.pem
  
  3. Load the certificate:
  
  