anchor.diff:  ** If you are using OSX El Capitan (10.11) or earlier, for ssh-agent to work a newer OpenSSH than is delivered with the system; macOS Sierra (10.12) contains a compatible version
   
   [NOTE]
  -The following example assume that you have not yet changed the management key.
  +The following example assume that you have not yet changed the management key. If you have changed the management key, add `--key` to the `yubico-piv-tool -a import-certificate` command below.
   
   
   Steps
  
positive.code: 
  1. Generate a key in slot 9a (any slot should suffice):
  
    $ yubico-piv-tool -s 9a -a generate -o public.pem
  
  2. Create a selfsigned certificate for that key.
  The only use for the X.509 certificate is to make PIV/PKCS#11 lib happy.
  They would want to be able to extract the public-key from the smartcard,
  and do that through the X.509 certificate.
  
    $ yubico-piv-tool -a verify-pin -P 123456 -a selfsign-certificate -s 9a \
          -S "/CN=SSH key/" -i public.pem -o cert.pem
  
  3. Load the certificate:
  
  
negative.code: 
     $ ssh-add -s $OPENSC_LIBS/opensc-pkcs11.so
  +
  NOTE: On OS X prior to macOS 10.12 “Sierra” this typically requires installation of a third-party OpenSSH from Homebrew or the like and using that ssh-agent.
  +
  To confirm that the ssh-agent correctly finds that key and getting the public key in correct format:
  
     $ ssh-add -L
  