Diff of the two buildlogs:

--
--- b1/build.log	2025-02-07 23:38:41.488405101 +0000
+++ b2/build.log	2025-02-07 23:42:29.182058017 +0000
@@ -1,6 +1,6 @@
 I: pbuilder: network access will be disabled during build
-I: Current time: Thu Mar 12 17:59:53 -12 2026
-I: pbuilder-time-stamp: 1773381593
+I: Current time: Sat Feb  8 13:38:43 +14 2025
+I: pbuilder-time-stamp: 1738971523
 I: Building the build Environment
 I: extracting base tarball [/var/cache/pbuilder/trixie-reproducible-base.tgz]
 I: copying local configuration
@@ -25,52 +25,84 @@
 dpkg-source: info: applying 0002-Add-back-MD2-RSA-to-MarshalJSON.patch
 I: Not using root during the build.
 I: Installing the build-deps
-I: user script /srv/workspace/pbuilder/3114959/tmp/hooks/D02_print_environment starting
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/D01_modify_environment starting
+debug: Running on ionos1-amd64.
+I: Changing host+domainname to test build reproducibility
+I: Adding a custom variable just for the fun of it...
+I: Changing /bin/sh to bash
+'/bin/sh' -> '/bin/bash'
+lrwxrwxrwx 1 root root 9 Feb  7 23:39 /bin/sh -> /bin/bash
+I: Setting pbuilder2's login shell to /bin/bash
+I: Setting pbuilder2's GECOS to second user,second room,second work-phone,second home-phone,second other
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/D01_modify_environment finished
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/D02_print_environment starting
 I: set
-  BUILDDIR='/build/reproducible-path'
-  BUILDUSERGECOS='first user,first room,first work-phone,first home-phone,first other'
-  BUILDUSERNAME='pbuilder1'
-  BUILD_ARCH='amd64'
-  DEBIAN_FRONTEND='noninteractive'
-  DEB_BUILD_OPTIONS='buildinfo=+all reproducible=+all parallel=42 '
-  DISTRIBUTION='trixie'
-  HOME='/root'
-  HOST_ARCH='amd64'
+  BASH=/bin/sh
+  BASHOPTS=checkwinsize:cmdhist:complete_fullquote:extquote:force_fignore:globasciiranges:globskipdots:hostcomplete:interactive_comments:patsub_replacement:progcomp:promptvars:sourcepath
+  BASH_ALIASES=()
+  BASH_ARGC=()
+  BASH_ARGV=()
+  BASH_CMDS=()
+  BASH_LINENO=([0]="12" [1]="0")
+  BASH_LOADABLES_PATH=/usr/local/lib/bash:/usr/lib/bash:/opt/local/lib/bash:/usr/pkg/lib/bash:/opt/pkg/lib/bash:.
+  BASH_SOURCE=([0]="/tmp/hooks/D02_print_environment" [1]="/tmp/hooks/D02_print_environment")
+  BASH_VERSINFO=([0]="5" [1]="2" [2]="37" [3]="1" [4]="release" [5]="x86_64-pc-linux-gnu")
+  BASH_VERSION='5.2.37(1)-release'
+  BUILDDIR=/build/reproducible-path
+  BUILDUSERGECOS='second user,second room,second work-phone,second home-phone,second other'
+  BUILDUSERNAME=pbuilder2
+  BUILD_ARCH=amd64
+  DEBIAN_FRONTEND=noninteractive
+  DEB_BUILD_OPTIONS='buildinfo=+all reproducible=+all parallel=20 '
+  DIRSTACK=()
+  DISTRIBUTION=trixie
+  EUID=0
+  FUNCNAME=([0]="Echo" [1]="main")
+  GROUPS=()
+  HOME=/root
+  HOSTNAME=i-capture-the-hostname
+  HOSTTYPE=x86_64
+  HOST_ARCH=amd64
   IFS=' 	
   '
-  INVOCATION_ID='e985cdd7d78847dc92c92780140f4b08'
-  LANG='C'
-  LANGUAGE='en_US:en'
-  LC_ALL='C'
-  MAIL='/var/mail/root'
-  OPTIND='1'
-  PATH='/usr/sbin:/usr/bin:/sbin:/bin:/usr/games'
-  PBCURRENTCOMMANDLINEOPERATION='build'
-  PBUILDER_OPERATION='build'
-  PBUILDER_PKGDATADIR='/usr/share/pbuilder'
-  PBUILDER_PKGLIBDIR='/usr/lib/pbuilder'
-  PBUILDER_SYSCONFDIR='/etc'
-  PPID='3114959'
-  PS1='# '
-  PS2='> '
+  INVOCATION_ID=fe06d04955fa4fd2a1b1b0427588664a
+  LANG=C
+  LANGUAGE=et_EE:et
+  LC_ALL=C
+  MACHTYPE=x86_64-pc-linux-gnu
+  MAIL=/var/mail/root
+  OPTERR=1
+  OPTIND=1
+  OSTYPE=linux-gnu
+  PATH=/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/i/capture/the/path
+  PBCURRENTCOMMANDLINEOPERATION=build
+  PBUILDER_OPERATION=build
+  PBUILDER_PKGDATADIR=/usr/share/pbuilder
+  PBUILDER_PKGLIBDIR=/usr/lib/pbuilder
+  PBUILDER_SYSCONFDIR=/etc
+  PIPESTATUS=([0]="0")
+  POSIXLY_CORRECT=y
+  PPID=3248060
   PS4='+ '
-  PWD='/'
-  SHELL='/bin/bash'
-  SHLVL='2'
-  SUDO_COMMAND='/usr/bin/timeout -k 18.1h 18h /usr/bin/ionice -c 3 /usr/bin/nice /usr/sbin/pbuilder --build --configfile /srv/reproducible-results/rbuild-debian/r-b-build.E3q30YSa/pbuilderrc_Octy --distribution trixie --hookdir /etc/pbuilder/first-build-hooks --debbuildopts -b --basetgz /var/cache/pbuilder/trixie-reproducible-base.tgz --buildresult /srv/reproducible-results/rbuild-debian/r-b-build.E3q30YSa/b1 --logfile b1/build.log golang-step-crypto_0.24.0-2.dsc'
-  SUDO_GID='110'
-  SUDO_UID='105'
-  SUDO_USER='jenkins'
-  TERM='unknown'
-  TZ='/usr/share/zoneinfo/Etc/GMT+12'
-  USER='root'
-  _='/usr/bin/systemd-run'
-  http_proxy='http://213.165.73.152:3128'
+  PWD=/
+  SHELL=/bin/bash
+  SHELLOPTS=braceexpand:errexit:hashall:interactive-comments:posix
+  SHLVL=3
+  SUDO_COMMAND='/usr/bin/timeout -k 24.1h 24h /usr/bin/ionice -c 3 /usr/bin/nice -n 11 /usr/bin/unshare --uts -- /usr/sbin/pbuilder --build --configfile /srv/reproducible-results/rbuild-debian/r-b-build.E3q30YSa/pbuilderrc_qHKS --distribution trixie --hookdir /etc/pbuilder/rebuild-hooks --debbuildopts -b --basetgz /var/cache/pbuilder/trixie-reproducible-base.tgz --buildresult /srv/reproducible-results/rbuild-debian/r-b-build.E3q30YSa/b2 --logfile b2/build.log golang-step-crypto_0.24.0-2.dsc'
+  SUDO_GID=110
+  SUDO_UID=105
+  SUDO_USER=jenkins
+  TERM=unknown
+  TZ=/usr/share/zoneinfo/Etc/GMT-14
+  UID=0
+  USER=root
+  _='I: set'
+  http_proxy=http://46.16.76.132:3128
 I: uname -a
-  Linux ionos5-amd64 6.12.9+bpo-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.9-1~bpo12+1 (2025-01-19) x86_64 GNU/Linux
+  Linux i-capture-the-hostname 6.1.0-30-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.124-1 (2025-01-12) x86_64 GNU/Linux
 I: ls -l /bin
-  lrwxrwxrwx 1 root root 7 Nov 22  2024 /bin -> usr/bin
-I: user script /srv/workspace/pbuilder/3114959/tmp/hooks/D02_print_environment finished
+  lrwxrwxrwx 1 root root 7 Nov 22 14:40 /bin -> usr/bin
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/D02_print_environment finished
  -> Attempting to satisfy build-dependencies
  -> Creating pbuilder-satisfydepends-dummy package
 Package: pbuilder-satisfydepends-dummy
@@ -188,7 +220,7 @@
 Get: 60 http://deb.debian.org/debian trixie/main amd64 golang-github-smallstep-assert-dev all 0.0~git20200723.82e2b9b-4 [5480 B]
 Get: 61 http://deb.debian.org/debian trixie/main amd64 golang-golang-x-net-dev all 1:0.27.0-1 [898 kB]
 Get: 62 http://deb.debian.org/debian trixie/main amd64 golang-gopkg-square-go-jose.v2-dev all 2.6.3-3 [267 kB]
-Fetched 75.0 MB in 2s (35.2 MB/s)
+Fetched 75.0 MB in 6s (12.4 MB/s)
 Preconfiguring packages ...
 Selecting previously unselected package tzdata.
 (Reading database ... 
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 19842 files and directories currently installed.)
@@ -401,8 +433,8 @@
 Setting up tzdata (2024b-6) ...
 
 Current default time zone: 'Etc/UTC'
-Local time is now:      Fri Mar 13 06:00:59 UTC 2026.
-Universal Time is now:  Fri Mar 13 06:00:59 UTC 2026.
+Local time is now:      Fri Feb  7 23:41:07 UTC 2025.
+Universal Time is now:  Fri Feb  7 23:41:07 UTC 2025.
 Run 'dpkg-reconfigure tzdata' if you wish to change it.
 
 Setting up golang-github-davecgh-go-spew-dev (1.1.1-3) ...
@@ -457,7 +489,11 @@
 Building tag database...
  -> Finished parsing the build-deps
 I: Building the package
-I: Running cd /build/reproducible-path/golang-step-crypto-0.24.0/ && env PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/games" HOME="/nonexistent/first-build" dpkg-buildpackage -us -uc -b && env PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/games" HOME="/nonexistent/first-build" dpkg-genchanges -S  > ../golang-step-crypto_0.24.0-2_source.changes
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/A99_set_merged_usr starting
+Not re-configuring usrmerge for trixie
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/A99_set_merged_usr finished
+hostname: Name or service not known
+I: Running cd /build/reproducible-path/golang-step-crypto-0.24.0/ && env PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/i/capture/the/path" HOME="/nonexistent/second-build" dpkg-buildpackage -us -uc -b && env PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/i/capture/the/path" HOME="/nonexistent/second-build" dpkg-genchanges -S  > ../golang-step-crypto_0.24.0-2_source.changes
 dpkg-buildpackage: info: source package golang-step-crypto
 dpkg-buildpackage: info: source version 0.24.0-2
 dpkg-buildpackage: info: source distribution unstable
@@ -475,41 +511,41 @@
    dh_autoreconf -O--builddirectory=_build -O--buildsystem=golang
    dh_auto_configure -O--builddirectory=_build -O--buildsystem=golang
    dh_auto_build -O--builddirectory=_build -O--buildsystem=golang
-	cd _build && go install -trimpath -v -p 42 go.step.sm/crypto/fingerprint go.step.sm/crypto/internal/bcrypt_pbkdf go.step.sm/crypto/internal/emoji go.step.sm/crypto/internal/step go.step.sm/crypto/internal/templates go.step.sm/crypto/internal/utils go.step.sm/crypto/jose go.step.sm/crypto/keyutil go.step.sm/crypto/minica go.step.sm/crypto/pemutil go.step.sm/crypto/randutil go.step.sm/crypto/sshutil go.step.sm/crypto/tlsutil go.step.sm/crypto/x25519 go.step.sm/crypto/x509util
-internal/coverage/rtcov
-encoding
-cmp
+	cd _build && go install -trimpath -v -p 20 go.step.sm/crypto/fingerprint go.step.sm/crypto/internal/bcrypt_pbkdf go.step.sm/crypto/internal/emoji go.step.sm/crypto/internal/step go.step.sm/crypto/internal/templates go.step.sm/crypto/internal/utils go.step.sm/crypto/jose go.step.sm/crypto/keyutil go.step.sm/crypto/minica go.step.sm/crypto/pemutil go.step.sm/crypto/randutil go.step.sm/crypto/sshutil go.step.sm/crypto/tlsutil go.step.sm/crypto/x25519 go.step.sm/crypto/x509util
 internal/profilerecord
-golang.org/x/crypto/internal/alias
-unicode/utf16
+internal/unsafeheader
+internal/goos
+internal/coverage/rtcov
 unicode/utf8
 internal/godebugs
-internal/goos
-internal/msan
-vendor/golang.org/x/crypto/internal/alias
-container/list
-internal/unsafeheader
 internal/byteorder
-math/bits
 internal/asan
-internal/nettrace
-internal/itoa
-log/internal
-crypto/internal/alias
-internal/race
-sync/atomic
-unicode
 internal/goarch
+internal/msan
 internal/runtime/syscall
-crypto/internal/boring/sig
-crypto/subtle
+internal/goexperiment
 internal/runtime/atomic
+cmp
+unicode
+sync/atomic
 internal/cpu
-internal/goexperiment
+internal/race
+internal/itoa
+math/bits
+crypto/internal/alias
+crypto/subtle
+crypto/internal/boring/sig
+log/internal
+encoding
+unicode/utf16
 vendor/golang.org/x/crypto/cryptobyte/asn1
+internal/nettrace
+golang.org/x/crypto/internal/alias
+container/list
+internal/abi
 runtime/internal/math
+vendor/golang.org/x/crypto/internal/alias
 runtime/internal/sys
-internal/abi
 internal/chacha8rand
 golang.org/x/crypto/salsa20/salsa
 internal/runtime/exithook
@@ -521,145 +557,145 @@
 iter
 internal/reflectlite
 sync
-maps
 slices
+maps
 internal/bisect
-internal/testlog
 internal/singleflight
+internal/testlog
 runtime/cgo
-internal/godebug
 errors
-internal/oserror
-path
+sort
+internal/godebug
 io
+path
 crypto/internal/edwards25519/field
-math/rand
-sort
 strconv
 vendor/golang.org/x/net/dns/dnsmessage
 math/rand/v2
+internal/oserror
 crypto/internal/nistec/fiat
-syscall
-crypto/internal/edwards25519
+math/rand
 hash
 crypto/internal/randutil
+golang.org/x/crypto/blowfish
 bytes
-strings
-hash/adler32
-hash/crc32
 internal/concurrent
-unique
+crypto/internal/edwards25519
+reflect
+strings
+syscall
 crypto
+go.step.sm/crypto/internal/emoji
+unique
 crypto/rc4
-golang.org/x/crypto/blowfish
 encoding/base32
-reflect
-net/netip
+regexp/syntax
+hash/adler32
+github.com/huandu/xstrings
+hash/crc32
+net/http/internal/ascii
+html
 crypto/md5
-vendor/golang.org/x/text/transform
-golang.org/x/text/transform
 crypto/cipher
-go.step.sm/crypto/internal/emoji
-net/http/internal/ascii
 bufio
-github.com/huandu/xstrings
-regexp/syntax
-html
+vendor/golang.org/x/text/transform
+golang.org/x/text/transform
+net/netip
+internal/syscall/execenv
+internal/syscall/unix
+time
 crypto/internal/boring
 crypto/des
+regexp
+crypto/aes
+crypto/sha256
 crypto/hmac
 crypto/sha512
 crypto/sha1
-crypto/sha256
-crypto/aes
 golang.org/x/crypto/pbkdf2
 vendor/golang.org/x/crypto/hkdf
-go.step.sm/crypto/internal/bcrypt_pbkdf
-golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
-internal/syscall/execenv
-internal/syscall/unix
-time
-regexp
-context
+internal/fmtsort
+encoding/binary
 io/fs
+context
 internal/poll
-internal/fmtsort
 internal/filepathlite
 embed
-encoding/binary
-crypto/internal/nistec
-os
 encoding/base64
 golang.org/x/crypto/chacha20
-vendor/golang.org/x/crypto/internal/poly1305
-vendor/golang.org/x/crypto/chacha20
+filippo.io/edwards25519/field
+go.step.sm/crypto/internal/bcrypt_pbkdf
+golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
 golang.org/x/crypto/internal/poly1305
+vendor/golang.org/x/crypto/chacha20
+vendor/golang.org/x/crypto/internal/poly1305
 golang.org/x/crypto/scrypt
-filippo.io/edwards25519/field
+crypto/internal/nistec
 encoding/pem
+os
 golang.org/x/crypto/nacl/secretbox
 filippo.io/edwards25519
 crypto/ecdh
-path/filepath
 fmt
+path/filepath
 vendor/golang.org/x/sys/cpu
-net
 golang.org/x/crypto/curve25519
-vendor/golang.org/x/crypto/chacha20poly1305
 vendor/golang.org/x/crypto/sha3
-log
-net/http/internal
+vendor/golang.org/x/crypto/chacha20poly1305
 encoding/hex
-compress/flate
-net/url
-mime/quotedprintable
-github.com/mitchellh/reflectwalk
-github.com/imdario/mergo
-mime
-github.com/pkg/errors
+log
 encoding/json
+math/big
 database/sql/driver
+github.com/imdario/mergo
+github.com/mitchellh/reflectwalk
+net/url
+github.com/pkg/errors
+text/template/parse
 gopkg.in/square/go-jose.v2/json
-os/user
+mime/quotedprintable
+net/http/internal
 vendor/golang.org/x/net/http2/hpack
-text/template/parse
-math/big
+compress/flate
 vendor/golang.org/x/text/unicode/norm
+mime
 golang.org/x/text/unicode/norm
-go.step.sm/crypto/internal/utils
 go.step.sm/crypto/fingerprint
-golang.org/x/text/unicode/bidi
 vendor/golang.org/x/text/unicode/bidi
+golang.org/x/text/unicode/bidi
+go.step.sm/crypto/internal/utils
 github.com/mitchellh/copystructure
 compress/gzip
-text/template
 golang.org/x/text/secure/bidirule
 vendor/golang.org/x/text/secure/bidirule
-golang.org/x/net/idna
+text/template
 vendor/golang.org/x/net/idna
+golang.org/x/net/idna
 github.com/Masterminds/semver
 crypto/dsa
-crypto/elliptic
-crypto/internal/bigmod
 crypto/internal/boring/bbig
-encoding/asn1
+crypto/internal/bigmod
 crypto/rand
+encoding/asn1
 github.com/shopspring/decimal
+crypto/elliptic
 crypto/ed25519
-golang.org/x/crypto/bcrypt
+github.com/Masterminds/goutils
 go.step.sm/crypto/randutil
+golang.org/x/crypto/bcrypt
 crypto/internal/hpke
-github.com/Masterminds/goutils
 crypto/internal/mlkem768
-html/template
-golang.org/x/crypto/ed25519
-go.step.sm/crypto/x25519
 crypto/rsa
+go.step.sm/crypto/x25519
+golang.org/x/crypto/ed25519
 vendor/golang.org/x/crypto/cryptobyte
 crypto/x509/pkix
-github.com/spf13/cast
+html/template
+os/user
+net
 crypto/ecdsa
 gopkg.in/square/go-jose.v2/cipher
+github.com/spf13/cast
 go.step.sm/crypto/internal/step
 net/textproto
 vendor/golang.org/x/net/http/httpproxy
@@ -678,14 +714,14 @@
 go.step.sm/crypto/keyutil
 golang.org/x/crypto/ssh/agent
 go.step.sm/crypto/pemutil
-go.step.sm/crypto/sshutil
 net/http/httptrace
 go.step.sm/crypto/tlsutil
-go.step.sm/crypto/minica
+go.step.sm/crypto/sshutil
 net/http
+go.step.sm/crypto/minica
 go.step.sm/crypto/jose
    dh_auto_test -O--builddirectory=_build -O--buildsystem=golang
-	cd _build && go test -vet=off -v -p 42 go.step.sm/crypto/fingerprint go.step.sm/crypto/internal/bcrypt_pbkdf go.step.sm/crypto/internal/emoji go.step.sm/crypto/internal/step go.step.sm/crypto/internal/templates go.step.sm/crypto/internal/utils go.step.sm/crypto/jose go.step.sm/crypto/keyutil go.step.sm/crypto/minica go.step.sm/crypto/pemutil go.step.sm/crypto/randutil go.step.sm/crypto/sshutil go.step.sm/crypto/tlsutil go.step.sm/crypto/x25519 go.step.sm/crypto/x509util
+	cd _build && go test -vet=off -v -p 20 go.step.sm/crypto/fingerprint go.step.sm/crypto/internal/bcrypt_pbkdf go.step.sm/crypto/internal/emoji go.step.sm/crypto/internal/step go.step.sm/crypto/internal/templates go.step.sm/crypto/internal/utils go.step.sm/crypto/jose go.step.sm/crypto/keyutil go.step.sm/crypto/minica go.step.sm/crypto/pemutil go.step.sm/crypto/randutil go.step.sm/crypto/sshutil go.step.sm/crypto/tlsutil go.step.sm/crypto/x25519 go.step.sm/crypto/x509util
 === RUN   TestNew
 === RUN   TestNew/sha256
 === RUN   TestNew/unavailable
@@ -713,13 +749,13 @@
     --- PASS: TestFingerprint/EmojiFingerprint (0.00s)
     --- PASS: TestFingerprint/Unknown (0.00s)
 PASS
-ok  	go.step.sm/crypto/fingerprint	0.003s
+ok  	go.step.sm/crypto/fingerprint	0.008s
 === RUN   TestKey
---- PASS: TestKey (0.18s)
+--- PASS: TestKey (0.22s)
 === RUN   TestBcryptHash
---- PASS: TestBcryptHash (0.00s)
+--- PASS: TestBcryptHash (0.01s)
 PASS
-ok  	go.step.sm/crypto/internal/bcrypt_pbkdf	0.190s
+ok  	go.step.sm/crypto/internal/bcrypt_pbkdf	0.233s
 === RUN   TestEmoji
 === RUN   TestEmoji/ok
 === RUN   TestEmoji/empty
@@ -729,7 +765,7 @@
     --- PASS: TestEmoji/empty (0.00s)
     --- PASS: TestEmoji/nil (0.00s)
 PASS
-ok  	go.step.sm/crypto/internal/emoji	0.003s
+ok  	go.step.sm/crypto/internal/emoji	0.004s
 === RUN   TestPath
 === RUN   TestPath/default
 --- PASS: TestPath (0.00s)
@@ -752,7 +788,7 @@
     config_test.go:93: 
 --- SKIP: Test_getUserHomeDir (0.00s)
 PASS
-ok  	go.step.sm/crypto/internal/step	0.004s
+ok  	go.step.sm/crypto/internal/step	0.012s
 === RUN   Test_GetFuncMap_fail
 --- PASS: Test_GetFuncMap_fail (0.00s)
 === RUN   TestValidateTemplate
@@ -798,7 +834,7 @@
     --- PASS: TestValidateTemplateData/ok_nil (0.00s)
     --- PASS: TestValidateTemplateData/fail/missing-comma-trailing-comma (0.00s)
 PASS
-ok  	go.step.sm/crypto/internal/templates	0.008s
+ok  	go.step.sm/crypto/internal/templates	0.013s
 === RUN   TestReadFile
 === RUN   TestReadFile/ok
 === RUN   TestReadFile/missing
@@ -826,7 +862,7 @@
     --- PASS: Test_maybeUnwrap/wrapped (0.00s)
     --- PASS: Test_maybeUnwrap/not_wrapped (0.00s)
 PASS
-ok  	go.step.sm/crypto/internal/utils	0.004s
+ok  	go.step.sm/crypto/internal/utils	0.008s
 === RUN   TestEncrypt
 === RUN   TestEncrypt/ok
 === RUN   TestEncrypt/ok_WithPasswordPrompter
@@ -837,10 +873,10 @@
 === RUN   TestEncrypt/fail_no_passowrd
 === RUN   TestEncrypt/fail_encrypt
 === RUN   TestEncrypt/fail_salt
---- PASS: TestEncrypt (0.36s)
-    --- PASS: TestEncrypt/ok (0.12s)
-    --- PASS: TestEncrypt/ok_WithPasswordPrompter (0.12s)
-    --- PASS: TestEncrypt/ok_with_PromptPassword (0.12s)
+--- PASS: TestEncrypt (0.69s)
+    --- PASS: TestEncrypt/ok (0.23s)
+    --- PASS: TestEncrypt/ok_WithPasswordPrompter (0.23s)
+    --- PASS: TestEncrypt/ok_with_PromptPassword (0.23s)
     --- PASS: TestEncrypt/fail_apply (0.00s)
     --- PASS: TestEncrypt/fail_WithPasswordPrompter (0.00s)
     --- PASS: TestEncrypt/fail_with_PromptPassword (0.00s)
@@ -852,8 +888,8 @@
 === RUN   TestEncryptJWK/fail_marshal
 === RUN   TestEncryptJWK/fail_encrypt
 === RUN   TestEncryptJWK/fail_salt
---- PASS: TestEncryptJWK (0.12s)
-    --- PASS: TestEncryptJWK/ok (0.12s)
+--- PASS: TestEncryptJWK (0.23s)
+    --- PASS: TestEncryptJWK/ok (0.23s)
     --- PASS: TestEncryptJWK/fail_marshal (0.00s)
     --- PASS: TestEncryptJWK/fail_encrypt (0.00s)
     --- PASS: TestEncryptJWK/fail_salt (0.00s)
@@ -875,18 +911,18 @@
 === RUN   TestDecrypt/fail_apply_WithPasswordPrompter
 === RUN   TestDecrypt/fail_PasswordPrompter#01
 === RUN   TestDecrypt/fail_WithFilename_and_PasswordPrompter
---- PASS: TestDecrypt (0.90s)
+--- PASS: TestDecrypt (1.70s)
     --- PASS: TestDecrypt/ok_not_encrypted (0.00s)
-    --- PASS: TestDecrypt/ok_WithPassword (0.06s)
-    --- PASS: TestDecrypt/ok_WithPasswordFile (0.06s)
-    --- PASS: TestDecrypt/ok_WithPasswordPrompter (0.06s)
-    --- PASS: TestDecrypt/ok_PasswordPrompter (0.06s)
-    --- PASS: TestDecrypt/ok_WithFilename_and_PasswordPrompter (0.06s)
-    --- PASS: TestDecrypt/fail_bad_data (0.06s)
-    --- PASS: TestDecrypt/fail_WithPassword (0.06s)
-    --- PASS: TestDecrypt/fail_WithPasswordFile (0.06s)
-    --- PASS: TestDecrypt/fail_WithPasswordPrompter (0.18s)
-    --- PASS: TestDecrypt/fail_PasswordPrompter (0.18s)
+    --- PASS: TestDecrypt/ok_WithPassword (0.11s)
+    --- PASS: TestDecrypt/ok_WithPasswordFile (0.11s)
+    --- PASS: TestDecrypt/ok_WithPasswordPrompter (0.11s)
+    --- PASS: TestDecrypt/ok_PasswordPrompter (0.11s)
+    --- PASS: TestDecrypt/ok_WithFilename_and_PasswordPrompter (0.11s)
+    --- PASS: TestDecrypt/fail_bad_data (0.11s)
+    --- PASS: TestDecrypt/fail_WithPassword (0.11s)
+    --- PASS: TestDecrypt/fail_WithPasswordFile (0.11s)
+    --- PASS: TestDecrypt/fail_WithPasswordPrompter (0.34s)
+    --- PASS: TestDecrypt/fail_PasswordPrompter (0.33s)
     --- PASS: TestDecrypt/fail_apply_WithPassword (0.00s)
     --- PASS: TestDecrypt/fail_apply_WithPasswordPrompter (0.00s)
     --- PASS: TestDecrypt/fail_PasswordPrompter#01 (0.00s)
@@ -899,7 +935,7 @@
 === RUN   TestThumbprint/okp
 === RUN   TestThumbprint/okp_pub
 === RUN   TestThumbprint/fail_oct
---- PASS: TestThumbprint (0.07s)
+--- PASS: TestThumbprint (0.00s)
     --- PASS: TestThumbprint/ec (0.00s)
     --- PASS: TestThumbprint/ec_pub (0.00s)
     --- PASS: TestThumbprint/rsa (0.00s)
@@ -928,112 +964,112 @@
 === RUN   TestGenerateDefaultKeyPair/failEmptyPassword
 === RUN   TestGenerateDefaultKeyPair/failNilPassword
 === RUN   TestGenerateDefaultKeyPair/failEOF
---- PASS: TestGenerateDefaultKeyPair (0.12s)
-    --- PASS: TestGenerateDefaultKeyPair/ok (0.06s)
+--- PASS: TestGenerateDefaultKeyPair (0.22s)
+    --- PASS: TestGenerateDefaultKeyPair/ok (0.11s)
     --- PASS: TestGenerateDefaultKeyPair/failEmptyPassword (0.00s)
     --- PASS: TestGenerateDefaultKeyPair/failNilPassword (0.00s)
     --- PASS: TestGenerateDefaultKeyPair/failEOF (0.00s)
 === RUN   TestReadKey
-=== RUN   TestReadKey/testdata/p256.pub.json
-=== RUN   TestReadKey/testdata/p256.enc.priv.json
-=== RUN   TestReadKey/testdata/rsa.priv.json
-=== RUN   TestReadKey/testdata/okp.pub.json
-=== RUN   TestReadKey/testdata/okp.priv.json
-=== RUN   TestReadKey/testdata/okp.enc.priv.json
 === RUN   TestReadKey/testdata/p256.priv.json
+=== RUN   TestReadKey/testdata/p256.enc.priv.json
 === RUN   TestReadKey/testdata/rsa.pub.json
+=== RUN   TestReadKey/testdata/rsa.priv.json
 === RUN   TestReadKey/testdata/rsa.enc.priv.json
 === RUN   TestReadKey/testdata/oct.json
 === RUN   TestReadKey/testdata/oct.enc.json
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.enc.pem
+=== RUN   TestReadKey/testdata/okp.pub.json
+=== RUN   TestReadKey/testdata/okp.priv.json
+=== RUN   TestReadKey/testdata/okp.enc.priv.json
+=== RUN   TestReadKey/testdata/p256.pub.json
+=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa2048.pem
 === RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p521.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa2048.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.enc.pem
 === RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p521.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa1024.enc.pem
 === RUN   TestReadKey/../pemutil/testdata/openssl.p256.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p256.enc.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p384.enc.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.enc.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p384.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p521.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa1024.pub.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.pub.pem
 === RUN   TestReadKey/../pemutil/testdata/openssl.p256.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p384.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p521.enc.pem
 === RUN   TestReadKey/../pemutil/testdata/openssl.rsa2048.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.pub.pem
 === RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p384.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p521.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa1024.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa2048.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.p384.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa1024.enc.pem
 === RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.pem
+=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa1024.pem
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.enc.pem
 === RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p256.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p384.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.p521.enc.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa1024.pub.pem
-=== RUN   TestReadKey/../pemutil/testdata/openssl.rsa2048.pem
---- PASS: TestReadKey (0.31s)
-    --- PASS: TestReadKey/testdata/p256.pub.json (0.00s)
-    --- PASS: TestReadKey/testdata/p256.enc.priv.json (0.06s)
-    --- PASS: TestReadKey/testdata/rsa.priv.json (0.00s)
-    --- PASS: TestReadKey/testdata/okp.pub.json (0.00s)
-    --- PASS: TestReadKey/testdata/okp.priv.json (0.00s)
-    --- PASS: TestReadKey/testdata/okp.enc.priv.json (0.06s)
+=== RUN   TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.enc.pem
+--- PASS: TestReadKey (0.50s)
     --- PASS: TestReadKey/testdata/p256.priv.json (0.00s)
+    --- PASS: TestReadKey/testdata/p256.enc.priv.json (0.11s)
     --- PASS: TestReadKey/testdata/rsa.pub.json (0.00s)
-    --- PASS: TestReadKey/testdata/rsa.enc.priv.json (0.10s)
+    --- PASS: TestReadKey/testdata/rsa.priv.json (0.00s)
+    --- PASS: TestReadKey/testdata/rsa.enc.priv.json (0.11s)
     --- PASS: TestReadKey/testdata/oct.json (0.00s)
-    --- PASS: TestReadKey/testdata/oct.enc.json (0.06s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.enc.pem (0.00s)
+    --- PASS: TestReadKey/testdata/oct.enc.json (0.11s)
+    --- PASS: TestReadKey/testdata/okp.pub.json (0.00s)
+    --- PASS: TestReadKey/testdata/okp.priv.json (0.00s)
+    --- PASS: TestReadKey/testdata/okp.enc.priv.json (0.11s)
+    --- PASS: TestReadKey/testdata/p256.pub.json (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa2048.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.pem (0.01s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p521.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa2048.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.enc.pem (0.01s)
     --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p521.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa1024.enc.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/openssl.p256.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p256.enc.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p384.enc.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.enc.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p521.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa1024.pub.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.pub.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/openssl.p256.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p384.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p521.enc.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.pub.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.pem (0.01s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p521.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa4096.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p521.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa1024.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa2048.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.p384.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa1024.enc.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p384.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa1024.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.ed25519.enc.pem (0.00s)
     --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p256.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p384.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.p521.enc.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa1024.pub.pem (0.00s)
-    --- PASS: TestReadKey/../pemutil/testdata/openssl.rsa2048.pem (0.00s)
+    --- PASS: TestReadKey/../pemutil/testdata/pkcs8/openssl.rsa2048.enc.pem (0.00s)
 === RUN   TestReadKey_https
 === RUN   TestReadKey_https/ok
 === RUN   TestReadKey_https/failWithKid
 === RUN   TestReadKey_https/failEmpty
 === RUN   TestReadKey_https/failNotFound
 === RUN   TestReadKey_https/failClient
-2026/03/12 18:01:30 http: TLS handshake error from 127.0.0.1:48894: remote error: tls: bad certificate
---- PASS: TestReadKey_https (0.01s)
+2025/02/08 13:42:01 http: TLS handshake error from 127.0.0.1:35168: remote error: tls: bad certificate
+--- PASS: TestReadKey_https (0.02s)
     --- PASS: TestReadKey_https/ok (0.01s)
     --- PASS: TestReadKey_https/failWithKid (0.00s)
     --- PASS: TestReadKey_https/failEmpty (0.00s)
     --- PASS: TestReadKey_https/failNotFound (0.00s)
-    --- PASS: TestReadKey_https/failClient (0.00s)
+    --- PASS: TestReadKey_https/failClient (0.01s)
 === RUN   TestReadKeyPasswordFile
 --- PASS: TestReadKeyPasswordFile (0.00s)
 === RUN   TestParseKey
@@ -1041,7 +1077,7 @@
 === RUN   TestParseKeyPemutilPromptPassword
 === RUN   TestParseKeyPemutilPromptPassword/ok
 === RUN   TestParseKeyPemutilPromptPassword/fail
---- PASS: TestParseKeyPemutilPromptPassword (0.00s)
+--- PASS: TestParseKeyPemutilPromptPassword (0.01s)
     --- PASS: TestParseKeyPemutilPromptPassword/ok (0.00s)
     --- PASS: TestParseKeyPemutilPromptPassword/fail (0.00s)
 === RUN   TestReadKeySet
@@ -1051,16 +1087,16 @@
 === RUN   TestReadKeySet_https/failEmpty
 === RUN   TestReadKeySet_https/failNotFound
 === RUN   TestReadKeySet_https/failClient
-2026/03/12 18:01:30 http: TLS handshake error from 127.0.0.1:58996: remote error: tls: bad certificate
+2025/02/08 13:42:01 http: TLS handshake error from 127.0.0.1:38470: remote error: tls: bad certificate
 === RUN   TestReadKeySet_https/failNoOptions
---- PASS: TestReadKeySet_https (0.01s)
-    --- PASS: TestReadKeySet_https/ok (0.00s)
+--- PASS: TestReadKeySet_https (0.03s)
+    --- PASS: TestReadKeySet_https/ok (0.01s)
     --- PASS: TestReadKeySet_https/failEmpty (0.00s)
     --- PASS: TestReadKeySet_https/failNotFound (0.00s)
-    --- PASS: TestReadKeySet_https/failClient (0.00s)
-    --- PASS: TestReadKeySet_https/failNoOptions (0.00s)
+    --- PASS: TestReadKeySet_https/failClient (0.01s)
+    --- PASS: TestReadKeySet_https/failNoOptions (0.01s)
 === RUN   TestGuessJWKAlgorithm
---- PASS: TestGuessJWKAlgorithm (0.23s)
+--- PASS: TestGuessJWKAlgorithm (0.36s)
 === RUN   TestParseKeySet
 === RUN   TestParseKeySet/ok
 === RUN   TestParseKeySet/okEncryptedJSON
@@ -1073,13 +1109,13 @@
 === RUN   TestParseKeySet/failEmpty
 === RUN   TestParseKeySet/failDuplicated
 === RUN   TestParseKeySet/failWithAlg
---- PASS: TestParseKeySet (0.24s)
+--- PASS: TestParseKeySet (0.46s)
     --- PASS: TestParseKeySet/ok (0.00s)
-    --- PASS: TestParseKeySet/okEncryptedJSON (0.06s)
-    --- PASS: TestParseKeySet/okEncryptedCompact (0.06s)
+    --- PASS: TestParseKeySet/okEncryptedJSON (0.11s)
+    --- PASS: TestParseKeySet/okEncryptedCompact (0.11s)
     --- PASS: TestParseKeySet/okWithAlgSubtle (0.00s)
     --- PASS: TestParseKeySet/failOptions (0.00s)
-    --- PASS: TestParseKeySet/failDecrypt (0.06s)
+    --- PASS: TestParseKeySet/failDecrypt (0.11s)
     --- PASS: TestParseKeySet/failNoOptions (0.00s)
     --- PASS: TestParseKeySet/failBadData (0.00s)
     --- PASS: TestParseKeySet/failEmpty (0.00s)
@@ -1096,7 +1132,7 @@
 === RUN   Test_guessKeyType/encryptedAlgHS256
 === RUN   Test_guessKeyType/jwkAlgHS384
 === RUN   Test_guessKeyType/bloblAlgHS512
---- PASS: Test_guessKeyType (0.64s)
+--- PASS: Test_guessKeyType (1.27s)
     --- PASS: Test_guessKeyType/ec (0.00s)
     --- PASS: Test_guessKeyType/rsaKey (0.00s)
     --- PASS: Test_guessKeyType/rsaPSSKey (0.00s)
@@ -1117,7 +1153,7 @@
 === RUN   Test_guessSignatureAlgorithm/XEdDSA
 === RUN   Test_guessSignatureAlgorithm/XEdDSA_with_X25519Signer
 === RUN   Test_guessSignatureAlgorithm/empty
---- PASS: Test_guessSignatureAlgorithm (0.52s)
+--- PASS: Test_guessSignatureAlgorithm (0.35s)
     --- PASS: Test_guessSignatureAlgorithm/byte (0.00s)
     --- PASS: Test_guessSignatureAlgorithm/ES256 (0.00s)
     --- PASS: Test_guessSignatureAlgorithm/ES384 (0.00s)
@@ -1135,7 +1171,7 @@
 === RUN   TestIsSymmetric/RSA#01
 === RUN   TestIsSymmetric/OKP
 === RUN   TestIsSymmetric/oct
---- PASS: TestIsSymmetric (0.43s)
+--- PASS: TestIsSymmetric (0.35s)
     --- PASS: TestIsSymmetric/EC (0.00s)
     --- PASS: TestIsSymmetric/RSA (0.00s)
     --- PASS: TestIsSymmetric/RSA#01 (0.00s)
@@ -1147,7 +1183,7 @@
 === RUN   TestIsAsymmetric/RSA#01
 === RUN   TestIsAsymmetric/OKP
 === RUN   TestIsAsymmetric/oct
---- PASS: TestIsAsymmetric (0.53s)
+--- PASS: TestIsAsymmetric (0.83s)
     --- PASS: TestIsAsymmetric/EC (0.00s)
     --- PASS: TestIsAsymmetric/RSA (0.00s)
     --- PASS: TestIsAsymmetric/RSA#01 (0.00s)
@@ -1170,31 +1206,31 @@
 === RUN   TestSignVerify/ed
 === RUN   TestSignVerify/x25519
 === RUN   TestSignVerify/fail_P224
---- PASS: TestSignVerify (0.13s)
+--- PASS: TestSignVerify (0.44s)
     --- PASS: TestSignVerify/byte (0.00s)
     --- PASS: TestSignVerify/P256 (0.00s)
     --- PASS: TestSignVerify/P384 (0.00s)
-    --- PASS: TestSignVerify/P521 (0.00s)
+    --- PASS: TestSignVerify/P521 (0.01s)
     --- PASS: TestSignVerify/rsa2048 (0.00s)
     --- PASS: TestSignVerify/ed (0.00s)
-    --- PASS: TestSignVerify/x25519 (0.00s)
+    --- PASS: TestSignVerify/x25519 (0.01s)
     --- PASS: TestSignVerify/fail_P224 (0.00s)
 === RUN   Test_validateX5
-=== RUN   Test_validateX5/ok
 === RUN   Test_validateX5/fail/empty-certs
 === RUN   Test_validateX5/fail/bad-key
 === RUN   Test_validateX5/fail/cert-not-approved-for-digital-signature
+=== RUN   Test_validateX5/ok
 --- PASS: Test_validateX5 (0.00s)
-    --- PASS: Test_validateX5/ok (0.00s)
     --- PASS: Test_validateX5/fail/empty-certs (0.00s)
     --- PASS: Test_validateX5/fail/bad-key (0.00s)
     --- PASS: Test_validateX5/fail/cert-not-approved-for-digital-signature (0.00s)
+    --- PASS: Test_validateX5/ok (0.00s)
 === RUN   TestValidateX5T
-=== RUN   TestValidateX5T/ok
 === RUN   TestValidateX5T/fail/validateX5-error
+=== RUN   TestValidateX5T/ok
 --- PASS: TestValidateX5T (0.00s)
-    --- PASS: TestValidateX5T/ok (0.00s)
     --- PASS: TestValidateX5T/fail/validateX5-error (0.00s)
+    --- PASS: TestValidateX5T/ok (0.00s)
 === RUN   TestValidateX5C
 === RUN   TestValidateX5C/fail/validateX5-error
 === RUN   TestValidateX5C/ok
@@ -1247,7 +1283,6 @@
     --- PASS: TestX25519Verifier_VerifyPayload/fail_algorithm (0.00s)
 === CONT  TestEncryptDecryptJWK
 === CONT  TestGenerateJWKFromPEM
-=== CONT  TestParseKey
 === CONT  TestGenerateJWK
 === RUN   TestGenerateJWK/EC
 === PAUSE TestGenerateJWK/EC
@@ -1262,6 +1297,7 @@
 === RUN   TestGenerateJWK/EC#05
 === PAUSE TestGenerateJWK/EC#05
 === RUN   TestGenerateJWK/EC#06
+=== CONT  TestParseKey
 === PAUSE TestGenerateJWK/EC#06
 === RUN   TestGenerateJWK/EC#07
 === PAUSE TestGenerateJWK/EC#07
@@ -1314,36 +1350,6 @@
 === RUN   TestGenerateJWK/fail
 === PAUSE TestGenerateJWK/fail
 === CONT  TestGenerateJWK/EC
-=== CONT  TestGenerateJWK/OKP
-=== CONT  TestGenerateJWK/oct#06
-=== CONT  TestGenerateJWK/EC#07
-=== CONT  TestGenerateJWK/RSA
-=== CONT  TestGenerateJWK/RSA#04
-=== CONT  TestGenerateJWK/oct
-=== CONT  TestGenerateJWK/oct#05
-=== CONT  TestGenerateJWK/OKP#01
-=== CONT  TestGenerateJWK/RSA#05
-=== CONT  TestGenerateJWK/fail
-=== CONT  TestGenerateJWK/EC#06
-=== CONT  TestGenerateJWK/RSA#06
-=== CONT  TestGenerateJWK/oct#11
-=== CONT  TestGenerateJWK/oct#08
-=== CONT  TestGenerateJWK/oct#10
-=== CONT  TestGenerateJWK/oct#07
-=== CONT  TestGenerateJWK/EC#04
-=== CONT  TestGenerateJWK/EC#05
-=== CONT  TestGenerateJWK/EC#03
-=== CONT  TestGenerateJWK/EC#02
-=== CONT  TestGenerateJWK/oct#01
-=== CONT  TestGenerateJWK/oct#04
-=== CONT  TestGenerateJWK/EC#01
-=== CONT  TestGenerateJWK/oct#03
-=== CONT  TestGenerateJWK/oct#02
-=== CONT  TestGenerateJWK/OKP#02
-=== CONT  TestGenerateJWK/RSA#02
-=== CONT  TestGenerateJWK/RSA#03
-=== CONT  TestGenerateJWK/RSA#01
-=== CONT  TestGenerateJWK/oct#09
 === RUN   TestGenerateJWKFromPEM/p256
 === PAUSE TestGenerateJWKFromPEM/p256
 === RUN   TestGenerateJWKFromPEM/p384
@@ -1359,7 +1365,6 @@
 === RUN   TestGenerateJWKFromPEM/p384_pub
 === PAUSE TestGenerateJWKFromPEM/p384_pub
 === RUN   TestGenerateJWKFromPEM/p521_pub
-=== CONT  TestGenerateJWK/RSA#07
 === PAUSE TestGenerateJWKFromPEM/p521_pub
 === RUN   TestGenerateJWKFromPEM/ed25519_pub
 === PAUSE TestGenerateJWKFromPEM/ed25519_pub
@@ -1376,36 +1381,67 @@
 === RUN   TestGenerateJWKFromPEM/fail_no_subtle
 === PAUSE TestGenerateJWKFromPEM/fail_no_subtle
 === CONT  TestGenerateJWKFromPEM/p256
-=== CONT  TestGenerateJWKFromPEM/p256_cert
-=== CONT  TestGenerateJWKFromPEM/p384_pub
-=== CONT  TestGenerateJWKFromPEM/ed25519_cert
-=== CONT  TestGenerateJWKFromPEM/rsa_pub
 === CONT  TestGenerateJWKFromPEM/fail_no_subtle
 === CONT  TestGenerateJWKFromPEM/fail_missing
+=== CONT  TestGenerateJWKFromPEM/p256_cert
+=== CONT  TestGenerateJWKFromPEM/ed25519_cert
 === CONT  TestGenerateJWKFromPEM/rsa_cert
+=== CONT  TestGenerateJWKFromPEM/rsa_pub
 === CONT  TestGenerateJWKFromPEM/ed25519_pub
 === CONT  TestGenerateJWKFromPEM/p521_pub
+=== CONT  TestGenerateJWKFromPEM/p384_pub
 === CONT  TestGenerateJWKFromPEM/p256_pub
 === CONT  TestGenerateJWKFromPEM/rsa
+=== CONT  TestGenerateJWKFromPEM/ed25519
 === CONT  TestGenerateJWKFromPEM/p521
 === CONT  TestGenerateJWKFromPEM/p384
-=== CONT  TestGenerateJWKFromPEM/ed25519
+=== CONT  TestGenerateJWK/OKP
+=== CONT  TestGenerateJWK/RSA
+=== CONT  TestGenerateJWK/RSA#04
+=== CONT  TestGenerateJWK/fail
+=== CONT  TestGenerateJWK/oct#11
+=== CONT  TestGenerateJWK/oct#10
+=== CONT  TestGenerateJWK/oct#09
+=== CONT  TestGenerateJWK/oct#08
+=== CONT  TestGenerateJWK/oct#07
+=== CONT  TestGenerateJWK/oct#06
+=== CONT  TestGenerateJWK/oct#05
+=== CONT  TestGenerateJWK/oct#04
+=== CONT  TestGenerateJWK/RSA#06
+=== CONT  TestGenerateJWK/oct#03
+=== CONT  TestGenerateJWK/oct#02
+=== CONT  TestGenerateJWK/oct#01
+=== CONT  TestGenerateJWK/oct
+=== CONT  TestGenerateJWK/OKP#02
+=== CONT  TestGenerateJWK/EC#04
+=== CONT  TestGenerateJWK/OKP#01
+=== CONT  TestGenerateJWK/RSA#07
+=== CONT  TestGenerateJWK/EC#07
+=== CONT  TestGenerateJWK/RSA#05
+=== CONT  TestGenerateJWK/RSA#03
+=== CONT  TestGenerateJWK/EC#06
+=== CONT  TestGenerateJWK/EC#05
+=== CONT  TestGenerateJWK/RSA#02
+=== CONT  TestGenerateJWK/RSA#01
+=== CONT  TestGenerateJWK/EC#02
+=== CONT  TestGenerateJWK/EC#01
+=== CONT  TestGenerateJWK/EC#03
 --- PASS: TestGenerateJWKFromPEM (0.00s)
     --- PASS: TestGenerateJWKFromPEM/p256 (0.00s)
-    --- PASS: TestGenerateJWKFromPEM/rsa_pub (0.00s)
-    --- PASS: TestGenerateJWKFromPEM/p384_pub (0.00s)
-    --- PASS: TestGenerateJWKFromPEM/ed25519_cert (0.00s)
     --- PASS: TestGenerateJWKFromPEM/fail_no_subtle (0.00s)
     --- PASS: TestGenerateJWKFromPEM/fail_missing (0.00s)
-    --- PASS: TestGenerateJWKFromPEM/ed25519_pub (0.00s)
-    --- PASS: TestGenerateJWKFromPEM/rsa_cert (0.00s)
     --- PASS: TestGenerateJWKFromPEM/p256_cert (0.00s)
+    --- PASS: TestGenerateJWKFromPEM/ed25519_cert (0.00s)
+    --- PASS: TestGenerateJWKFromPEM/rsa_cert (0.00s)
+    --- PASS: TestGenerateJWKFromPEM/rsa_pub (0.00s)
+    --- PASS: TestGenerateJWKFromPEM/ed25519_pub (0.00s)
     --- PASS: TestGenerateJWKFromPEM/p521_pub (0.00s)
+    --- PASS: TestGenerateJWKFromPEM/p384_pub (0.00s)
     --- PASS: TestGenerateJWKFromPEM/p256_pub (0.00s)
     --- PASS: TestGenerateJWKFromPEM/rsa (0.00s)
     --- PASS: TestGenerateJWKFromPEM/ed25519 (0.00s)
-    --- PASS: TestGenerateJWKFromPEM/p384 (0.00s)
     --- PASS: TestGenerateJWKFromPEM/p521 (0.00s)
+    --- PASS: TestGenerateJWKFromPEM/p384 (0.01s)
 === RUN   TestEncryptDecryptJWK/ok_EC
 === PAUSE TestEncryptDecryptJWK/ok_EC
 === RUN   TestEncryptDecryptJWK/ok_EC_pub
@@ -1426,23 +1462,13 @@
 === PAUSE TestEncryptDecryptJWK/ok_oct
 === CONT  TestEncryptDecryptJWK/ok_EC
 === CONT  TestEncryptDecryptJWK/ok_RSA-PSS_pub
-=== CONT  TestEncryptDecryptJWK/ok_Ed25519_pub
-=== CONT  TestEncryptDecryptJWK/ok_RSA_pub
+=== CONT  TestEncryptDecryptJWK/ok_RSA-PSS
 === CONT  TestEncryptDecryptJWK/ok_oct
+=== CONT  TestEncryptDecryptJWK/ok_Ed25519_pub
 === CONT  TestEncryptDecryptJWK/ok_Ed25519
-=== CONT  TestEncryptDecryptJWK/ok_RSA-PSS
 === CONT  TestEncryptDecryptJWK/ok_RSA
+=== CONT  TestEncryptDecryptJWK/ok_RSA_pub
 === CONT  TestEncryptDecryptJWK/ok_EC_pub
---- PASS: TestEncryptDecryptJWK (0.48s)
-    --- PASS: TestEncryptDecryptJWK/ok_RSA_pub (0.12s)
-    --- PASS: TestEncryptDecryptJWK/ok_RSA-PSS (0.12s)
-    --- PASS: TestEncryptDecryptJWK/ok_EC_pub (0.13s)
-    --- PASS: TestEncryptDecryptJWK/ok_RSA-PSS_pub (0.13s)
-    --- PASS: TestEncryptDecryptJWK/ok_EC (0.14s)
-    --- PASS: TestEncryptDecryptJWK/ok_Ed25519_pub (0.15s)
-    --- PASS: TestEncryptDecryptJWK/ok_oct (0.16s)
-    --- PASS: TestEncryptDecryptJWK/ok_RSA (0.16s)
-    --- PASS: TestEncryptDecryptJWK/ok_Ed25519 (0.17s)
 === RUN   TestParseKey/ec
 === PAUSE TestParseKey/ec
 === RUN   TestParseKey/rsa
@@ -1492,89 +1518,99 @@
 === RUN   TestParseKey/failOCTMissingOptions
 === PAUSE TestParseKey/failOCTMissingOptions
 === CONT  TestParseKey/ec
+=== CONT  TestParseKey/failOCTMissingOptions
+=== CONT  TestParseKey/failECWrongKid
 === CONT  TestParseKey/failECBWongAlg
+=== CONT  TestParseKey/failPEMPassword
+=== CONT  TestParseKey/failMissingFile
+=== CONT  TestParseKey/pemPrivateWithPasswordFile
 === CONT  TestParseKey/failPassword
+=== CONT  TestParseKey/pemPrivateWithPassword
 === CONT  TestParseKey/octPrivateWithAlgWithKid
-=== CONT  TestParseKey/pemPublic
-=== CONT  TestParseKey/failPEMPassword
 === CONT  TestParseKey/octPrivateWithAlg
-=== CONT  TestParseKey/pemPrivateWithPassword
+=== CONT  TestParseKey/pemPrivateWithAlgWithSubtle
+=== CONT  TestParseKey/pemPrivateWithAlg
+=== CONT  TestParseKey/pemPrivateWithUse
+=== CONT  TestParseKey/pemPrivateWithKid
+=== CONT  TestParseKey/pemPrivateWithPasswordPrompter
+=== CONT  TestParseKey/pemPublic
 === CONT  TestParseKey/pemPrivate
-=== CONT  TestParseKey/failOCTMissingOptions
 === CONT  TestParseKey/encryptedFullWithPasswordFile
-=== CONT  TestParseKey/failECWrongKid
 === CONT  TestParseKey/encryptedCompactWithPassword
+=== CONT  TestParseKey/oct
 === CONT  TestParseKey/okp
 === CONT  TestParseKey/rsa-pss
-=== CONT  TestParseKey/oct
-=== CONT  TestParseKey/pemPrivateWithAlgWithSubtle
-=== CONT  TestParseKey/pemPrivateWithKid
-=== CONT  TestParseKey/pemPrivateWithAlg
-=== CONT  TestParseKey/pemPrivateWithUse
-=== CONT  TestParseKey/failMissingFile
-=== CONT  TestParseKey/pemPrivateWithPasswordFile
-=== CONT  TestParseKey/pemPrivateWithPasswordPrompter
 === CONT  TestParseKey/rsa
---- PASS: TestParseKey (0.81s)
+--- PASS: TestParseKey (1.97s)
     --- PASS: TestParseKey/ec (0.00s)
-    --- PASS: TestParseKey/octPrivateWithAlgWithKid (0.00s)
-    --- PASS: TestParseKey/failECBWongAlg (0.00s)
-    --- PASS: TestParseKey/octPrivateWithAlg (0.00s)
-    --- PASS: TestParseKey/pemPublic (0.00s)
     --- PASS: TestParseKey/failOCTMissingOptions (0.00s)
     --- PASS: TestParseKey/failECWrongKid (0.00s)
-    --- PASS: TestParseKey/pemPrivate (0.00s)
-    --- PASS: TestParseKey/oct (0.00s)
-    --- PASS: TestParseKey/okp (0.00s)
+    --- PASS: TestParseKey/failECBWongAlg (0.00s)
+    --- PASS: TestParseKey/failPEMPassword (0.00s)
+    --- PASS: TestParseKey/pemPrivateWithPasswordFile (0.00s)
+    --- PASS: TestParseKey/pemPrivateWithPassword (0.00s)
+    --- PASS: TestParseKey/octPrivateWithAlgWithKid (0.00s)
+    --- PASS: TestParseKey/octPrivateWithAlg (0.00s)
     --- PASS: TestParseKey/pemPrivateWithAlgWithSubtle (0.00s)
     --- PASS: TestParseKey/pemPrivateWithAlg (0.00s)
-    --- PASS: TestParseKey/pemPrivateWithKid (0.00s)
     --- PASS: TestParseKey/pemPrivateWithUse (0.00s)
-    --- PASS: TestParseKey/rsa-pss (0.00s)
+    --- PASS: TestParseKey/pemPrivateWithKid (0.00s)
     --- PASS: TestParseKey/failMissingFile (0.00s)
-    --- PASS: TestParseKey/rsa (0.00s)
-    --- PASS: TestParseKey/pemPrivateWithPassword (0.00s)
-    --- PASS: TestParseKey/failPEMPassword (0.00s)
-    --- PASS: TestParseKey/pemPrivateWithPasswordFile (0.00s)
     --- PASS: TestParseKey/pemPrivateWithPasswordPrompter (0.00s)
-    --- PASS: TestParseKey/encryptedFullWithPasswordFile (0.06s)
-    --- PASS: TestParseKey/failPassword (0.07s)
-    --- PASS: TestParseKey/encryptedCompactWithPassword (0.07s)
+    --- PASS: TestParseKey/pemPublic (0.00s)
+    --- PASS: TestParseKey/pemPrivate (0.00s)
+    --- PASS: TestParseKey/oct (0.00s)
+    --- PASS: TestParseKey/okp (0.00s)
+    --- PASS: TestParseKey/rsa (0.00s)
+    --- PASS: TestParseKey/rsa-pss (0.00s)
+    --- PASS: TestParseKey/encryptedFullWithPasswordFile (0.27s)
+    --- PASS: TestParseKey/encryptedCompactWithPassword (0.33s)
+    --- PASS: TestParseKey/failPassword (0.41s)
+--- PASS: TestEncryptDecryptJWK (1.63s)
+    --- PASS: TestEncryptDecryptJWK/ok_RSA-PSS_pub (0.63s)
+    --- PASS: TestEncryptDecryptJWK/ok_EC (0.65s)
+    --- PASS: TestEncryptDecryptJWK/ok_oct (0.63s)
+    --- PASS: TestEncryptDecryptJWK/ok_Ed25519 (0.66s)
+    --- PASS: TestEncryptDecryptJWK/ok_RSA_pub (0.66s)
+    --- PASS: TestEncryptDecryptJWK/ok_Ed25519_pub (0.74s)
+    --- PASS: TestEncryptDecryptJWK/ok_RSA (0.71s)
+    --- PASS: TestEncryptDecryptJWK/ok_EC_pub (0.74s)
+    --- PASS: TestEncryptDecryptJWK/ok_RSA-PSS (0.80s)
 --- PASS: TestGenerateJWK (0.00s)
     --- PASS: TestGenerateJWK/EC (0.00s)
-    --- PASS: TestGenerateJWK/EC#07 (0.00s)
     --- PASS: TestGenerateJWK/OKP (0.00s)
-    --- PASS: TestGenerateJWK/oct#06 (0.00s)
     --- PASS: TestGenerateJWK/fail (0.00s)
-    --- PASS: TestGenerateJWK/EC#06 (0.00s)
+    --- PASS: TestGenerateJWK/oct#11 (0.00s)
+    --- PASS: TestGenerateJWK/oct#10 (0.00s)
+    --- PASS: TestGenerateJWK/oct#09 (0.00s)
     --- PASS: TestGenerateJWK/oct#08 (0.00s)
     --- PASS: TestGenerateJWK/oct#07 (0.00s)
-    --- PASS: TestGenerateJWK/oct#10 (0.00s)
-    --- PASS: TestGenerateJWK/EC#04 (0.00s)
-    --- PASS: TestGenerateJWK/EC#05 (0.00s)
-    --- PASS: TestGenerateJWK/oct (0.00s)
-    --- PASS: TestGenerateJWK/oct#11 (0.00s)
-    --- PASS: TestGenerateJWK/oct#01 (0.00s)
-    --- PASS: TestGenerateJWK/OKP#01 (0.00s)
+    --- PASS: TestGenerateJWK/oct#06 (0.00s)
     --- PASS: TestGenerateJWK/oct#05 (0.00s)
     --- PASS: TestGenerateJWK/oct#04 (0.00s)
-    --- PASS: TestGenerateJWK/EC#02 (0.00s)
-    --- PASS: TestGenerateJWK/EC#01 (0.00s)
-    --- PASS: TestGenerateJWK/oct#02 (0.00s)
     --- PASS: TestGenerateJWK/oct#03 (0.00s)
+    --- PASS: TestGenerateJWK/oct#02 (0.00s)
+    --- PASS: TestGenerateJWK/oct#01 (0.00s)
+    --- PASS: TestGenerateJWK/oct (0.00s)
     --- PASS: TestGenerateJWK/OKP#02 (0.00s)
+    --- PASS: TestGenerateJWK/OKP#01 (0.00s)
+    --- PASS: TestGenerateJWK/EC#04 (0.00s)
+    --- PASS: TestGenerateJWK/EC#07 (0.00s)
+    --- PASS: TestGenerateJWK/EC#06 (0.00s)
+    --- PASS: TestGenerateJWK/EC#05 (0.00s)
+    --- PASS: TestGenerateJWK/EC#02 (0.00s)
+    --- PASS: TestGenerateJWK/EC#01 (0.00s)
     --- PASS: TestGenerateJWK/EC#03 (0.00s)
-    --- PASS: TestGenerateJWK/oct#09 (0.00s)
-    --- PASS: TestGenerateJWK/RSA#05 (0.09s)
-    --- PASS: TestGenerateJWK/RSA#06 (0.12s)
-    --- PASS: TestGenerateJWK/RSA (0.22s)
-    --- PASS: TestGenerateJWK/RSA#07 (0.23s)
+    --- PASS: TestGenerateJWK/RSA#07 (0.26s)
+    --- PASS: TestGenerateJWK/RSA#06 (0.27s)
     --- PASS: TestGenerateJWK/RSA#04 (0.31s)
-    --- PASS: TestGenerateJWK/RSA#02 (0.33s)
-    --- PASS: TestGenerateJWK/RSA#03 (0.35s)
-    --- PASS: TestGenerateJWK/RSA#01 (1.75s)
+    --- PASS: TestGenerateJWK/RSA#05 (0.48s)
+    --- PASS: TestGenerateJWK/RSA#03 (0.53s)
+    --- PASS: TestGenerateJWK/RSA (1.15s)
+    --- PASS: TestGenerateJWK/RSA#02 (1.28s)
+    --- PASS: TestGenerateJWK/RSA#01 (6.12s)
 PASS
-ok  	go.step.sm/crypto/jose	6.413s
+ok  	go.step.sm/crypto/jose	13.598s
 === RUN   TestPublicKey
 === RUN   TestPublicKey/ecdsa
 === RUN   TestPublicKey/ecdsaPublic
@@ -1585,7 +1621,7 @@
 === RUN   TestPublicKey/x25519
 === RUN   TestPublicKey/x25519Public
 === RUN   TestPublicKey/fail
---- PASS: TestPublicKey (0.08s)
+--- PASS: TestPublicKey (0.10s)
     --- PASS: TestPublicKey/ecdsa (0.00s)
     --- PASS: TestPublicKey/ecdsaPublic (0.00s)
     --- PASS: TestPublicKey/rsa (0.00s)
@@ -1620,10 +1656,10 @@
 === RUN   TestGenerateKey/unknown_EC_curve
 === RUN   TestGenerateKey/unknown_OKP_curve
 === RUN   TestGenerateKey/unknown_type
---- PASS: TestGenerateKey (0.02s)
+--- PASS: TestGenerateKey (0.03s)
     --- PASS: TestGenerateKey/P-256 (0.00s)
-    --- PASS: TestGenerateKey/P-384 (0.00s)
-    --- PASS: TestGenerateKey/P-521 (0.01s)
+    --- PASS: TestGenerateKey/P-384 (0.01s)
+    --- PASS: TestGenerateKey/P-521 (0.02s)
     --- PASS: TestGenerateKey/Ed25519 (0.00s)
     --- PASS: TestGenerateKey/OCT (0.00s)
     --- PASS: TestGenerateKey/eof_EC (0.00s)
@@ -1638,9 +1674,9 @@
 === RUN   TestGenerateKey_rsa/RSA3072
 === RUN   TestGenerateKey_rsa/fail
 === RUN   TestGenerateKey_rsa/fail_size
---- PASS: TestGenerateKey_rsa (0.74s)
-    --- PASS: TestGenerateKey_rsa/RSA2048 (0.12s)
-    --- PASS: TestGenerateKey_rsa/RSA3072 (0.62s)
+--- PASS: TestGenerateKey_rsa (5.18s)
+    --- PASS: TestGenerateKey_rsa/RSA2048 (0.29s)
+    --- PASS: TestGenerateKey_rsa/RSA3072 (4.89s)
     --- PASS: TestGenerateKey_rsa/fail (0.00s)
     --- PASS: TestGenerateKey_rsa/fail_size (0.00s)
 === RUN   TestGenerateKeyPair
@@ -1655,7 +1691,7 @@
 --- PASS: TestGenerateKeyPair (0.01s)
     --- PASS: TestGenerateKeyPair/P-256 (0.00s)
     --- PASS: TestGenerateKeyPair/P-384 (0.00s)
-    --- PASS: TestGenerateKeyPair/P-521 (0.00s)
+    --- PASS: TestGenerateKeyPair/P-521 (0.01s)
     --- PASS: TestGenerateKeyPair/Ed25519 (0.00s)
     --- PASS: TestGenerateKeyPair/OCT (0.00s)
     --- PASS: TestGenerateKeyPair/eof (0.00s)
@@ -1665,9 +1701,9 @@
 === RUN   TestGenerateKeyPair_rsa/RSA2048
 === RUN   TestGenerateKeyPair_rsa/RSA3072
 === RUN   TestGenerateKeyPair_rsa/fail
---- PASS: TestGenerateKeyPair_rsa (1.24s)
-    --- PASS: TestGenerateKeyPair_rsa/RSA2048 (0.35s)
-    --- PASS: TestGenerateKeyPair_rsa/RSA3072 (0.89s)
+--- PASS: TestGenerateKeyPair_rsa (2.11s)
+    --- PASS: TestGenerateKeyPair_rsa/RSA2048 (0.53s)
+    --- PASS: TestGenerateKeyPair_rsa/RSA3072 (1.58s)
     --- PASS: TestGenerateKeyPair_rsa/fail (0.00s)
 === RUN   TestGenerateDefaultSigner
 === RUN   TestGenerateDefaultSigner/ok
@@ -1686,7 +1722,7 @@
 --- PASS: TestGenerateSigner (0.01s)
     --- PASS: TestGenerateSigner/P-256 (0.00s)
     --- PASS: TestGenerateSigner/P-384 (0.00s)
-    --- PASS: TestGenerateSigner/P-521 (0.00s)
+    --- PASS: TestGenerateSigner/P-521 (0.01s)
     --- PASS: TestGenerateSigner/Ed25519 (0.00s)
     --- PASS: TestGenerateSigner/OCT (0.00s)
     --- PASS: TestGenerateSigner/unknown (0.00s)
@@ -1706,7 +1742,7 @@
 === RUN   TestExtractKey/fail_string
 === RUN   TestExtractKey/fail_bad_ssh.Certificate.Key
 === RUN   TestExtractKey/fail_bad_ssh.PublicKey
---- PASS: TestExtractKey (0.31s)
+--- PASS: TestExtractKey (1.17s)
     --- PASS: TestExtractKey/RSA_private_key (0.00s)
     --- PASS: TestExtractKey/RSA_public_key (0.00s)
     --- PASS: TestExtractKey/EC_private_key (0.00s)
@@ -1732,7 +1768,7 @@
 === RUN   TestVerifyPair/fail_rsa_key
 === RUN   TestVerifyPair/fail_ed25519_key
 === RUN   TestVerifyPair/fail_type
---- PASS: TestVerifyPair (1.12s)
+--- PASS: TestVerifyPair (0.63s)
     --- PASS: TestVerifyPair/ecdsa (0.00s)
     --- PASS: TestVerifyPair/rsa (0.00s)
     --- PASS: TestVerifyPair/ed25519 (0.00s)
@@ -1748,13 +1784,13 @@
 === RUN   TestInsecure/fail_RSA_1024
 === RUN   TestInsecure/ok_RSA_2048_insecure
 === RUN   TestInsecure/ok_RSA_1024_insecure
---- PASS: TestInsecure (0.37s)
-    --- PASS: TestInsecure/ok_RSA_2048 (0.08s)
+--- PASS: TestInsecure (2.19s)
+    --- PASS: TestInsecure/ok_RSA_2048 (1.61s)
     --- PASS: TestInsecure/fail_RSA_1024 (0.00s)
-    --- PASS: TestInsecure/ok_RSA_2048_insecure (0.27s)
-    --- PASS: TestInsecure/ok_RSA_1024_insecure (0.01s)
+    --- PASS: TestInsecure/ok_RSA_2048_insecure (0.54s)
+    --- PASS: TestInsecure/ok_RSA_1024_insecure (0.03s)
 PASS
-ok  	go.step.sm/crypto/keyutil	3.902s
+ok  	go.step.sm/crypto/keyutil	11.490s
 === RUN   TestNew
 === RUN   TestNew/ok
 === RUN   TestNew/ok_with_options
@@ -1768,7 +1804,7 @@
 === RUN   TestNew/fail_intermediate_csr
 === RUN   TestNew/fail_host_ssh_signer
 === RUN   TestNew/fail_user_ssh_signer
---- PASS: TestNew (0.01s)
+--- PASS: TestNew (0.03s)
     --- PASS: TestNew/ok (0.00s)
     --- PASS: TestNew/ok_with_options (0.00s)
     --- PASS: TestNew/fail_root_signer (0.00s)
@@ -1790,7 +1826,7 @@
     --- PASS: TestCA_Sign/ok_with_lifetime (0.00s)
     --- PASS: TestCA_Sign/fail (0.00s)
 === RUN   TestCA_Sign_mutation
---- PASS: TestCA_Sign_mutation (0.00s)
+--- PASS: TestCA_Sign_mutation (0.01s)
 === RUN   TestCA_SignCSR
 === RUN   TestCA_SignCSR/ok
 === RUN   TestCA_SignCSR/ok_with_modify
@@ -1816,7 +1852,7 @@
 === RUN   TestCA_SignSSH_infinity
 --- PASS: TestCA_SignSSH_infinity (0.00s)
 PASS
-ok  	go.step.sm/crypto/minica	0.049s
+ok  	go.step.sm/crypto/minica	0.079s
 === RUN   TestParseCosignPrivateKey
 === RUN   TestParseCosignPrivateKey/ok
 === RUN   TestParseCosignPrivateKey/fail_password
@@ -1831,134 +1867,134 @@
 === RUN   TestParseCosignPrivateKey/fail_kdf.Salt
 === RUN   TestParseCosignPrivateKey/fail_ciphertext
 === RUN   TestParseCosignPrivateKey/fail_parsePKCS8PrivateKey
---- PASS: TestParseCosignPrivateKey (1.10s)
-    --- PASS: TestParseCosignPrivateKey/ok (0.11s)
-    --- PASS: TestParseCosignPrivateKey/fail_password (0.11s)
+--- PASS: TestParseCosignPrivateKey (1.80s)
+    --- PASS: TestParseCosignPrivateKey/ok (0.19s)
+    --- PASS: TestParseCosignPrivateKey/fail_password (0.21s)
     --- PASS: TestParseCosignPrivateKey/fail_unmarshal (0.00s)
     --- PASS: TestParseCosignPrivateKey/fail_kdf (0.00s)
     --- PASS: TestParseCosignPrivateKey/fail_cipher (0.00s)
     --- PASS: TestParseCosignPrivateKey/fail_nonce_too_large (0.00s)
     --- PASS: TestParseCosignPrivateKey/fail_nonce_too_short (0.00s)
     --- PASS: TestParseCosignPrivateKey/fail_kdf.N (0.00s)
-    --- PASS: TestParseCosignPrivateKey/fail_kdf.R (0.13s)
-    --- PASS: TestParseCosignPrivateKey/fail_kdf.P (0.21s)
-    --- PASS: TestParseCosignPrivateKey/fail_kdf.Salt (0.11s)
-    --- PASS: TestParseCosignPrivateKey/fail_ciphertext (0.17s)
-    --- PASS: TestParseCosignPrivateKey/fail_parsePKCS8PrivateKey (0.14s)
+    --- PASS: TestParseCosignPrivateKey/fail_kdf.R (0.24s)
+    --- PASS: TestParseCosignPrivateKey/fail_kdf.P (0.36s)
+    --- PASS: TestParseCosignPrivateKey/fail_kdf.Salt (0.19s)
+    --- PASS: TestParseCosignPrivateKey/fail_ciphertext (0.19s)
+    --- PASS: TestParseCosignPrivateKey/fail_parsePKCS8PrivateKey (0.19s)
 === RUN   TestParseCosignPrivateKey_equal
---- PASS: TestParseCosignPrivateKey_equal (0.11s)
+--- PASS: TestParseCosignPrivateKey_equal (0.21s)
 === RUN   TestParseCosignPrivateKey_IncorrectPasswordError
---- PASS: TestParseCosignPrivateKey_IncorrectPasswordError (0.22s)
+--- PASS: TestParseCosignPrivateKey_IncorrectPasswordError (0.47s)
 === RUN   TestRead
-=== RUN   TestRead/testdata/openssh.p384.pub.pem
-=== RUN   TestRead/testdata/nebula.key
-=== RUN   TestRead/testdata/openssl.p256.enc.pem
-=== RUN   TestRead/testdata/openssl.rsa2048.pub.pem
-=== RUN   TestRead/testdata/openssh.rsa1024.pem
+=== RUN   TestRead/testdata/openssl.rsa2048.enc.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p521.pem
+=== RUN   TestRead/testdata/openssl.p256.pem
+=== RUN   TestRead/testdata/openssl.p521.enc.pem
 === RUN   TestRead/testdata/openssl.rsa1024.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.ed25519.pub.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p256.enc.pem
 === RUN   TestRead/testdata/pkcs8/openssl.rsa4096.pem
+=== RUN   TestRead/testdata/openssh.p256.enc.pem
+=== RUN   TestRead/testdata/openssh.rsa1024.pub.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.ed25519.enc.pem
 === RUN   TestRead/testdata/cosign.pub.pem
-=== RUN   TestRead/testdata/openssl.p384.pub.pem
+=== RUN   TestRead/testdata/openssh.rsa1024.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p521.pub.pem
+=== RUN   TestRead/testdata/nebula.pub
 === RUN   TestRead/testdata/openssl.rsa1024.enc.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.rsa4096.pub.pem
+=== RUN   TestRead/testdata/openssh.p256.pub.pem
+=== RUN   TestRead/testdata/openssh.p521.pub.pem
 === RUN   TestRead/testdata/pkcs8/openssl.ed25519.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p256.pub.pem
+=== RUN   TestRead/testdata/openssl.p521.pub.pem
+=== RUN   TestRead/testdata/openssh.p256.pem
+=== RUN   TestRead/testdata/openssh.p521.pem
+=== RUN   TestRead/testdata/openssl.p384.enc.pem
+=== RUN   TestRead/testdata/openssl.rsa2048.pub.pem
+=== RUN   TestRead/testdata/openssh.rsa2048.enc.pem
+=== RUN   TestRead/testdata/cosign.enc.pem
+=== RUN   TestRead/testdata/openssl.p256.pub.pem
+=== RUN   TestRead/testdata/openssl.p256.enc.pem
+=== RUN   TestRead/testdata/openssh.ed25519.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p521.enc.pem
+=== RUN   TestRead/testdata/openssl.rsa1024.pub.pem
+=== RUN   TestRead/testdata/openssl.p521.pem
+=== RUN   TestRead/testdata/openssh.ed25519.pub.pem
 === RUN   TestRead/testdata/openssh.p384.enc.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.rsa4096.pub.pem
 === RUN   TestRead/testdata/openssh.p384.pem
 === RUN   TestRead/testdata/openssh.rsa2048.pem
-=== RUN   TestRead/testdata/openssl.p256.pub.pem
-=== RUN   TestRead/testdata/openssl.p521.enc.pem
-=== RUN   TestRead/testdata/openssl.rsa2048.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p521.pem
 === RUN   TestRead/testdata/openssl.p384.pem
-=== RUN   TestRead/testdata/openssl.p521.pem
+=== RUN   TestRead/testdata/openssl.rsa2048.pem
+=== RUN   TestRead/testdata/openssh.rsa1024.enc.pem
 === RUN   TestRead/testdata/pkcs8/openssl.p256.pem
-=== RUN   TestRead/testdata/openssl.p521.pub.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.ed25519.pub.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p384.pem
-=== RUN   TestRead/testdata/openssh.rsa2048.enc.pem
+=== RUN   TestRead/testdata/openssl.p384.pub.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p384.pub.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p384.enc.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.rsa2048.pem
 === RUN   TestRead/testdata/openssh.ed25519.enc.pem
-=== RUN   TestRead/testdata/openssh.p521.pub.pem
-=== RUN   TestRead/testdata/openssh.rsa1024.pub.pem
-=== RUN   TestRead/testdata/openssh.ed25519.pub.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p256.pub.pem
-=== RUN   TestRead/testdata/cosign.enc.pem
-=== RUN   TestRead/testdata/openssl.p384.enc.pem
-=== RUN   TestRead/testdata/openssh.p256.pub.pem
+=== RUN   TestRead/testdata/openssh.p384.pub.pem
+=== RUN   TestRead/testdata/openssh.p521.enc.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.p384.pem
+=== RUN   TestRead/testdata/pkcs8/openssl.rsa2048.enc.pem
+=== RUN   TestRead/testdata/nebula.key
 === RUN   TestRead/testdata/openssh.rsa2048.pub.pem
-=== RUN   TestRead/testdata/nebula.pub
-=== RUN   TestRead/testdata/openssh.p256.enc.pem
-=== RUN   TestRead/testdata/openssh.p256.pem
 === RUN   TestRead/testdata/pkcs8/openssl.rsa2048.pub.pem
-=== RUN   TestRead/testdata/openssh.p521.pem
-=== RUN   TestRead/testdata/openssh.rsa1024.enc.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p384.enc.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p521.pub.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.rsa2048.enc.pem
-=== RUN   TestRead/testdata/openssh.ed25519.pem
-=== RUN   TestRead/testdata/openssh.p521.enc.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p256.enc.pem
-=== RUN   TestRead/testdata/openssl.p256.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p384.pub.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.rsa2048.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.p521.enc.pem
-=== RUN   TestRead/testdata/openssl.rsa1024.pub.pem
-=== RUN   TestRead/testdata/openssl.rsa2048.enc.pem
-=== RUN   TestRead/testdata/pkcs8/openssl.ed25519.enc.pem
---- PASS: TestRead (1.39s)
-    --- PASS: TestRead/testdata/openssh.p384.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/nebula.key (0.04s)
-    --- PASS: TestRead/testdata/openssl.p256.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.rsa2048.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.rsa1024.pem (0.00s)
+--- PASS: TestRead (1.49s)
+    --- PASS: TestRead/testdata/openssl.rsa2048.enc.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p521.pem (0.03s)
+    --- PASS: TestRead/testdata/openssl.p256.pem (0.00s)
+    --- PASS: TestRead/testdata/openssl.p521.enc.pem (0.01s)
     --- PASS: TestRead/testdata/openssl.rsa1024.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.rsa4096.pem (0.01s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.ed25519.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.rsa4096.pem (0.03s)
+    --- PASS: TestRead/testdata/openssh.p256.enc.pem (0.18s)
+    --- PASS: TestRead/testdata/openssh.rsa1024.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.ed25519.enc.pem (0.01s)
     --- PASS: TestRead/testdata/cosign.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.rsa1024.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p521.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/nebula.pub (0.00s)
     --- PASS: TestRead/testdata/openssl.rsa1024.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.ed25519.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.p384.enc.pem (0.25s)
     --- PASS: TestRead/testdata/pkcs8/openssl.rsa4096.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.p256.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.p521.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.ed25519.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p256.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssl.p521.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.p256.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.p521.pem (0.01s)
+    --- PASS: TestRead/testdata/openssl.p384.enc.pem (0.01s)
+    --- PASS: TestRead/testdata/openssl.rsa2048.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.rsa2048.enc.pem (0.19s)
+    --- PASS: TestRead/testdata/cosign.enc.pem (0.19s)
+    --- PASS: TestRead/testdata/openssl.p256.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssl.p256.enc.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.ed25519.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p521.enc.pem (0.01s)
+    --- PASS: TestRead/testdata/openssl.rsa1024.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssl.p521.pem (0.01s)
+    --- PASS: TestRead/testdata/openssh.ed25519.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.p384.enc.pem (0.19s)
     --- PASS: TestRead/testdata/openssh.p384.pem (0.00s)
     --- PASS: TestRead/testdata/openssh.rsa2048.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.p256.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.p521.enc.pem (0.01s)
-    --- PASS: TestRead/testdata/openssl.rsa2048.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p521.pem (0.00s)
     --- PASS: TestRead/testdata/openssl.p384.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.p521.pem (0.00s)
+    --- PASS: TestRead/testdata/openssl.rsa2048.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.rsa1024.enc.pem (0.19s)
     --- PASS: TestRead/testdata/pkcs8/openssl.p256.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.p521.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.ed25519.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.p384.enc.pem (0.01s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.ed25519.enc.pem (0.18s)
+    --- PASS: TestRead/testdata/openssh.p384.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/openssh.p521.enc.pem (0.19s)
     --- PASS: TestRead/testdata/pkcs8/openssl.p384.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.rsa2048.enc.pem (0.15s)
-    --- PASS: TestRead/testdata/openssh.ed25519.enc.pem (0.21s)
-    --- PASS: TestRead/testdata/openssh.p521.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.rsa1024.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.ed25519.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p256.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/cosign.enc.pem (0.12s)
-    --- PASS: TestRead/testdata/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.p256.pub.pem (0.00s)
+    --- PASS: TestRead/testdata/pkcs8/openssl.rsa2048.enc.pem (0.01s)
+    --- PASS: TestRead/testdata/nebula.key (0.00s)
     --- PASS: TestRead/testdata/openssh.rsa2048.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/nebula.pub (0.00s)
-    --- PASS: TestRead/testdata/openssh.p256.enc.pem (0.15s)
-    --- PASS: TestRead/testdata/openssh.p256.pem (0.00s)
     --- PASS: TestRead/testdata/pkcs8/openssl.rsa2048.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.p521.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.rsa1024.enc.pem (0.15s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p521.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.ed25519.pem (0.00s)
-    --- PASS: TestRead/testdata/openssh.p521.enc.pem (0.24s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.p256.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p384.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.p521.enc.pem (0.01s)
-    --- PASS: TestRead/testdata/openssl.rsa1024.pub.pem (0.00s)
-    --- PASS: TestRead/testdata/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestRead/testdata/pkcs8/openssl.ed25519.enc.pem (0.00s)
 === RUN   TestParseCertificate
 === RUN   TestParseCertificate/testdata/ca.crt
 === RUN   TestParseCertificate/testdata/bundle.crt
@@ -2020,51 +2056,51 @@
 === RUN   TestReadCertificateBundle
 --- PASS: TestReadCertificateBundle (0.00s)
 === RUN   TestParse
-=== RUN   TestParse/fail-type
-=== RUN   TestParse/success-ecdsa-private-key
-=== RUN   TestParse/success-ed25519-private-key
 === RUN   TestParse/success-ed25519-enc-private-key
+=== RUN   TestParse/fail-type
+=== RUN   TestParse/fail-nebula-key-size
+=== RUN   TestParse/success-x509-crt
+=== RUN   TestParse/fail-password
 === RUN   TestParse/success-x509-crt-trim-spaces
+=== RUN   TestParse/success-ecdsa-public-key
+=== RUN   TestParse/success-rsa-public-key
+=== RUN   TestParse/success-ed25519-private-key
 === RUN   TestParse/fail-options
-=== RUN   TestParse/fail-password
 === RUN   TestParse/fail-pkcs8-password
 === RUN   TestParse/fail-nebula-pub-size
-=== RUN   TestParse/success-rsa-public-key
-=== RUN   TestParse/fail-nebula-key-size
-=== RUN   TestParse/success-x509-crt
-=== RUN   TestParse/success-ecdsa-public-key
 === RUN   TestParse/success-rsa-private-key
---- PASS: TestParse (0.00s)
-    --- PASS: TestParse/fail-type (0.00s)
-    --- PASS: TestParse/success-ecdsa-private-key (0.00s)
-    --- PASS: TestParse/success-ed25519-private-key (0.00s)
+=== RUN   TestParse/success-ecdsa-private-key
+--- PASS: TestParse (0.01s)
     --- PASS: TestParse/success-ed25519-enc-private-key (0.00s)
+    --- PASS: TestParse/fail-type (0.00s)
+    --- PASS: TestParse/fail-nebula-key-size (0.00s)
+    --- PASS: TestParse/success-x509-crt (0.00s)
+    --- PASS: TestParse/fail-password (0.00s)
     --- PASS: TestParse/success-x509-crt-trim-spaces (0.00s)
+    --- PASS: TestParse/success-ecdsa-public-key (0.00s)
+    --- PASS: TestParse/success-rsa-public-key (0.00s)
+    --- PASS: TestParse/success-ed25519-private-key (0.00s)
     --- PASS: TestParse/fail-options (0.00s)
-    --- PASS: TestParse/fail-password (0.00s)
     --- PASS: TestParse/fail-pkcs8-password (0.00s)
     --- PASS: TestParse/fail-nebula-pub-size (0.00s)
-    --- PASS: TestParse/success-rsa-public-key (0.00s)
-    --- PASS: TestParse/fail-nebula-key-size (0.00s)
-    --- PASS: TestParse/success-x509-crt (0.00s)
-    --- PASS: TestParse/success-ecdsa-public-key (0.00s)
     --- PASS: TestParse/success-rsa-private-key (0.00s)
+    --- PASS: TestParse/success-ecdsa-private-key (0.00s)
 === RUN   TestSerialize
-    pem_test.go:657: Running test case: RSA Public Key success
     pem_test.go:657: Running test case: EC Public Key success
+    pem_test.go:657: Running test case: propagate open key out file error
+    pem_test.go:657: Running test case: ToFile Success (EC Private Key unencrypted)
+    pem_test.go:657: Running test case: ToFile Success (EC Private Key encrypted)
+    pem_test.go:657: Running test case: EC Private Key success - encrypt pkcs8 data
     pem_test.go:657: Running test case: OKP Public Key success
-    pem_test.go:657: Running test case: X.509 Certificate success
-    pem_test.go:657: Running test case: RSA Private Key success
-    pem_test.go:657: Running test case: unrecognized key type
     pem_test.go:657: Running test case: EC Private Key success
+    pem_test.go:657: Running test case: X.509 Certificate success
+    pem_test.go:657: Running test case: RSA Public Key success
     pem_test.go:657: Running test case: EC Private Key success - encrypt input data
     pem_test.go:657: Running test case: OKP Private Key success
-    pem_test.go:657: Running test case: EC Private Key success - encrypt pkcs8 data
     pem_test.go:657: Running test case: X.509 Certificate request success
-    pem_test.go:657: Running test case: propagate open key out file error
-    pem_test.go:657: Running test case: ToFile Success (EC Private Key unencrypted)
-    pem_test.go:657: Running test case: ToFile Success (EC Private Key encrypted)
---- PASS: TestSerialize (0.76s)
+    pem_test.go:657: Running test case: unrecognized key type
+    pem_test.go:657: Running test case: RSA Private Key success
+--- PASS: TestSerialize (0.61s)
 === RUN   TestParseDER
 === RUN   TestParseDER/rsa_public_key
 === RUN   TestParseDER/rsa_private_key
@@ -2084,119 +2120,119 @@
     --- PASS: TestParseDER/ed25519_private_key (0.00s)
     --- PASS: TestParseDER/fail (0.00s)
 === RUN   TestParseKey
-=== RUN   TestParseKey/testdata/openssl.p521.pub.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.ed25519.pub.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p384.pem
-=== RUN   TestParseKey/testdata/openssh.rsa2048.enc.pem
-=== RUN   TestParseKey/testdata/openssh.ed25519.enc.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p256.pub.pem
-=== RUN   TestParseKey/testdata/cosign.enc.pem
-=== RUN   TestParseKey/testdata/openssl.p384.enc.pem
-=== RUN   TestParseKey/testdata/nebula.pub
-=== RUN   TestParseKey/testdata/openssh.p256.enc.pem
-=== RUN   TestParseKey/testdata/openssh.p256.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.rsa2048.pub.pem
-=== RUN   TestParseKey/testdata/openssh.p521.pem
+=== RUN   TestParseKey/testdata/openssl.rsa1024.pub.pem
+=== RUN   TestParseKey/testdata/openssh.p384.enc.pem
+=== RUN   TestParseKey/testdata/openssh.p384.pem
+=== RUN   TestParseKey/testdata/openssh.rsa2048.pem
+=== RUN   TestParseKey/testdata/openssl.p521.pem
 === RUN   TestParseKey/testdata/openssh.rsa1024.enc.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p256.pem
+=== RUN   TestParseKey/testdata/openssl.p384.pem
+=== RUN   TestParseKey/testdata/openssl.rsa2048.pem
 === RUN   TestParseKey/testdata/pkcs8/openssl.p384.enc.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p521.pub.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.rsa2048.enc.pem
-=== RUN   TestParseKey/testdata/openssh.ed25519.pem
-=== RUN   TestParseKey/testdata/openssh.p521.enc.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p256.enc.pem
-=== RUN   TestParseKey/testdata/openssl.p256.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p384.pub.pem
 === RUN   TestParseKey/testdata/pkcs8/openssl.rsa2048.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p521.enc.pem
-=== RUN   TestParseKey/testdata/openssl.rsa1024.pub.pem
-=== RUN   TestParseKey/testdata/openssl.rsa2048.enc.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.ed25519.enc.pem
+=== RUN   TestParseKey/testdata/openssl.p384.pub.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p384.pub.pem
+=== RUN   TestParseKey/testdata/openssh.p521.enc.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p384.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.rsa2048.enc.pem
 === RUN   TestParseKey/testdata/nebula.key
-=== RUN   TestParseKey/testdata/openssl.p256.enc.pem
-=== RUN   TestParseKey/testdata/openssl.rsa2048.pub.pem
-=== RUN   TestParseKey/testdata/openssh.rsa1024.pem
+=== RUN   TestParseKey/testdata/openssh.ed25519.enc.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.rsa2048.pub.pem
+=== RUN   TestParseKey/testdata/openssl.rsa2048.enc.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p521.pem
 === RUN   TestParseKey/testdata/openssl.rsa1024.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.ed25519.pub.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p256.enc.pem
 === RUN   TestParseKey/testdata/pkcs8/openssl.rsa4096.pem
+=== RUN   TestParseKey/testdata/openssl.p256.pem
+=== RUN   TestParseKey/testdata/openssl.p521.enc.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.ed25519.enc.pem
 === RUN   TestParseKey/testdata/cosign.pub.pem
-=== RUN   TestParseKey/testdata/openssl.p384.pub.pem
+=== RUN   TestParseKey/testdata/openssh.p256.enc.pem
+=== RUN   TestParseKey/testdata/nebula.pub
+=== RUN   TestParseKey/testdata/openssh.rsa1024.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p521.pub.pem
 === RUN   TestParseKey/testdata/openssl.rsa1024.enc.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.ed25519.pem
-=== RUN   TestParseKey/testdata/openssh.p384.enc.pem
 === RUN   TestParseKey/testdata/pkcs8/openssl.rsa4096.pub.pem
-=== RUN   TestParseKey/testdata/openssh.p384.pem
-=== RUN   TestParseKey/testdata/openssh.rsa2048.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.ed25519.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p256.pub.pem
+=== RUN   TestParseKey/testdata/openssh.p521.pem
+=== RUN   TestParseKey/testdata/openssl.p521.pub.pem
+=== RUN   TestParseKey/testdata/openssh.p256.pem
+=== RUN   TestParseKey/testdata/openssl.p384.enc.pem
+=== RUN   TestParseKey/testdata/openssl.rsa2048.pub.pem
+=== RUN   TestParseKey/testdata/openssh.rsa2048.enc.pem
+=== RUN   TestParseKey/testdata/cosign.enc.pem
+=== RUN   TestParseKey/testdata/openssh.ed25519.pem
+=== RUN   TestParseKey/testdata/pkcs8/openssl.p521.enc.pem
 === RUN   TestParseKey/testdata/openssl.p256.pub.pem
-=== RUN   TestParseKey/testdata/openssl.p521.enc.pem
-=== RUN   TestParseKey/testdata/openssl.rsa2048.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p521.pem
-=== RUN   TestParseKey/testdata/openssl.p384.pem
-=== RUN   TestParseKey/testdata/openssl.p521.pem
-=== RUN   TestParseKey/testdata/pkcs8/openssl.p256.pem
---- PASS: TestParseKey (1.03s)
-    --- PASS: TestParseKey/testdata/openssl.p521.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.ed25519.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p384.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.rsa2048.enc.pem (0.15s)
-    --- PASS: TestParseKey/testdata/openssh.ed25519.enc.pem (0.15s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p256.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/cosign.enc.pem (0.11s)
-    --- PASS: TestParseKey/testdata/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/nebula.pub (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.p256.enc.pem (0.15s)
-    --- PASS: TestParseKey/testdata/openssh.p256.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa2048.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.p521.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.rsa1024.enc.pem (0.15s)
+=== RUN   TestParseKey/testdata/openssl.p256.enc.pem
+--- PASS: TestParseKey (1.36s)
+    --- PASS: TestParseKey/testdata/openssl.rsa1024.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.p384.enc.pem (0.19s)
+    --- PASS: TestParseKey/testdata/openssh.p384.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.rsa2048.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p521.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.rsa1024.enc.pem (0.19s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p256.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p384.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.rsa2048.pem (0.00s)
     --- PASS: TestParseKey/testdata/pkcs8/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p521.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.ed25519.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.p521.enc.pem (0.15s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.p256.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p384.pub.pem (0.00s)
     --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p521.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.rsa1024.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.ed25519.enc.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.p521.enc.pem (0.19s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p384.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa2048.enc.pem (0.00s)
     --- PASS: TestParseKey/testdata/nebula.key (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.p256.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.rsa2048.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.rsa1024.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.ed25519.enc.pem (0.18s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa2048.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.rsa2048.enc.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p521.pem (0.00s)
     --- PASS: TestParseKey/testdata/openssl.rsa1024.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.ed25519.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
     --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa4096.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p256.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p521.enc.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.ed25519.enc.pem (0.00s)
     --- PASS: TestParseKey/testdata/cosign.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.p384.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.p256.enc.pem (0.19s)
+    --- PASS: TestParseKey/testdata/nebula.pub (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.rsa1024.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p521.pub.pem (0.00s)
     --- PASS: TestParseKey/testdata/openssl.rsa1024.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.ed25519.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.p384.enc.pem (0.15s)
     --- PASS: TestParseKey/testdata/pkcs8/openssl.rsa4096.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.p384.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssh.rsa2048.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.ed25519.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p256.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.p521.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p521.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.p256.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p384.enc.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.rsa2048.pub.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssh.rsa2048.enc.pem (0.19s)
+    --- PASS: TestParseKey/testdata/cosign.enc.pem (0.20s)
+    --- PASS: TestParseKey/testdata/openssh.ed25519.pem (0.00s)
+    --- PASS: TestParseKey/testdata/pkcs8/openssl.p521.enc.pem (0.00s)
     --- PASS: TestParseKey/testdata/openssl.p256.pub.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.p521.enc.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.rsa2048.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p521.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.p384.pem (0.00s)
-    --- PASS: TestParseKey/testdata/openssl.p521.pem (0.00s)
-    --- PASS: TestParseKey/testdata/pkcs8/openssl.p256.pem (0.00s)
+    --- PASS: TestParseKey/testdata/openssl.p256.enc.pem (0.00s)
 === RUN   TestParseKey_x509
 --- PASS: TestParseKey_x509 (0.00s)
 === RUN   TestParseSSH
 === RUN   TestParseSSH/testdata/openssh.p384.pub.pem
-=== RUN   TestParseSSH/testdata/openssh.p521.pub.pem
+=== RUN   TestParseSSH/testdata/openssh.rsa2048.pub.pem
 === RUN   TestParseSSH/testdata/openssh.rsa1024.pub.pem
-=== RUN   TestParseSSH/testdata/openssh.ed25519.pub.pem
 === RUN   TestParseSSH/testdata/openssh.p256.pub.pem
-=== RUN   TestParseSSH/testdata/openssh.rsa2048.pub.pem
+=== RUN   TestParseSSH/testdata/openssh.p521.pub.pem
+=== RUN   TestParseSSH/testdata/openssh.ed25519.pub.pem
 --- PASS: TestParseSSH (0.00s)
     --- PASS: TestParseSSH/testdata/openssh.p384.pub.pem (0.00s)
-    --- PASS: TestParseSSH/testdata/openssh.p521.pub.pem (0.00s)
+    --- PASS: TestParseSSH/testdata/openssh.rsa2048.pub.pem (0.00s)
     --- PASS: TestParseSSH/testdata/openssh.rsa1024.pub.pem (0.00s)
-    --- PASS: TestParseSSH/testdata/openssh.ed25519.pub.pem (0.00s)
     --- PASS: TestParseSSH/testdata/openssh.p256.pub.pem (0.00s)
-    --- PASS: TestParseSSH/testdata/openssh.rsa2048.pub.pem (0.00s)
+    --- PASS: TestParseSSH/testdata/openssh.p521.pub.pem (0.00s)
+    --- PASS: TestParseSSH/testdata/openssh.ed25519.pub.pem (0.00s)
 === RUN   TestOpenSSH
 === PAUSE TestOpenSSH
 === RUN   TestRead_options
@@ -2262,239 +2298,239 @@
     --- PASS: TestSerialize_PKCS8/ed25519_pub (0.00s)
     --- PASS: TestSerialize_PKCS8/fail (0.00s)
 === RUN   TestDecryptPKCS8PrivateKey
+=== RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.ed25519.enc.pem
+=== RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p521.enc.pem
 === RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p384.enc.pem
 === RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.rsa2048.enc.pem
 === RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p256.enc.pem
-=== RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.ed25519.enc.pem
-=== RUN   TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p521.enc.pem
---- PASS: TestDecryptPKCS8PrivateKey (0.01s)
-    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p384.enc.pem (0.00s)
-    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.rsa2048.enc.pem (0.00s)
-    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
+--- PASS: TestDecryptPKCS8PrivateKey (0.03s)
     --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.ed25519.enc.pem (0.00s)
-    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p521.enc.pem (0.00s)
+    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p521.enc.pem (0.01s)
+    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p384.enc.pem (0.01s)
+    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.rsa2048.enc.pem (0.01s)
+    --- PASS: TestDecryptPKCS8PrivateKey/testdata/pkcs8/openssl.p256.enc.pem (0.00s)
 === RUN   TestDecryptPKCS8PrivateKey_ciphers
 === RUN   TestDecryptPKCS8PrivateKey_ciphers/DES-CBC
 === RUN   TestDecryptPKCS8PrivateKey_ciphers/DES-EDE3-CBC
 === RUN   TestDecryptPKCS8PrivateKey_ciphers/AES-128-CBC
 === RUN   TestDecryptPKCS8PrivateKey_ciphers/AES-192-CBC
 === RUN   TestDecryptPKCS8PrivateKey_ciphers/AES-256-CBC
---- PASS: TestDecryptPKCS8PrivateKey_ciphers (0.89s)
-    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/DES-CBC (0.18s)
-    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/DES-EDE3-CBC (0.18s)
-    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/AES-128-CBC (0.18s)
-    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/AES-192-CBC (0.18s)
-    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/AES-256-CBC (0.18s)
+--- PASS: TestDecryptPKCS8PrivateKey_ciphers (1.90s)
+    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/DES-CBC (0.37s)
+    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/DES-EDE3-CBC (0.33s)
+    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/AES-128-CBC (0.33s)
+    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/AES-192-CBC (0.44s)
+    --- PASS: TestDecryptPKCS8PrivateKey_ciphers/AES-256-CBC (0.44s)
 === CONT  TestOpenSSH
-=== CONT  TestEncryptDecryptPKCS8
-=== RUN   TestOpenSSH/testdata/openssl.rsa1024.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssl.rsa1024.enc.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.p384.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.p384.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem
 === RUN   TestOpenSSH/testdata/openssh.p384.enc.pem
 === PAUSE TestOpenSSH/testdata/openssh.p384.enc.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem
-=== RUN   TestOpenSSH/testdata/openssl.p521.enc.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem
-=== PAUSE TestOpenSSH/testdata/openssl.p521.enc.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssl.p521.pem
-=== RUN   TestOpenSSH/testdata/openssl.rsa2048.pem
-=== PAUSE TestOpenSSH/testdata/openssl.rsa2048.pem
 === RUN   TestOpenSSH/testdata/openssh.p384.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssl.p521.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem
 === PAUSE TestOpenSSH/testdata/openssh.p384.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssl.p384.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssl.p384.pem
 === RUN   TestOpenSSH/testdata/openssh.rsa2048.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem
 === PAUSE TestOpenSSH/testdata/openssh.rsa2048.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem
 === RUN   TestOpenSSH/testdata/openssl.p521.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.p256.pem
 === PAUSE TestOpenSSH/testdata/openssl.p521.pem
+=== RUN   TestOpenSSH/testdata/openssl.rsa2048.pem
+=== PAUSE TestOpenSSH/testdata/openssl.rsa2048.pem
+=== RUN   TestOpenSSH/testdata/openssh.rsa1024.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssh.rsa1024.enc.pem
 === RUN   TestOpenSSH/testdata/pkcs8/openssl.p256.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.p256.pem
 === PAUSE TestOpenSSH/testdata/pkcs8/openssl.p256.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.p521.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.p521.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p521.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p521.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem
 === RUN   TestOpenSSH/testdata/openssl.p384.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem
 === PAUSE TestOpenSSH/testdata/openssl.p384.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem
+=== RUN   TestOpenSSH/testdata/openssh.p521.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssh.p521.enc.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p384.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p384.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem
+=== CONT  TestEncryptDecryptPKCS8
+=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem
 === RUN   TestEncryptDecryptPKCS8/testdata/openssl.p256.pem
 === PAUSE TestEncryptDecryptPKCS8/testdata/openssl.p256.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem
 === RUN   TestEncryptDecryptPKCS8/testdata/openssl.rsa1024.pem
 === PAUSE TestEncryptDecryptPKCS8/testdata/openssl.rsa1024.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem
 === RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.ed25519.pem
 === PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.ed25519.pem
-=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem
-=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p384.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p384.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.ed25519.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.p256.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.p256.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.p521.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.p521.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.p384.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.p384.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssl.p521.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssl.p521.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssl.p384.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssl.p384.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem
+=== RUN   TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem
+=== PAUSE TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem
 === CONT  TestEncryptDecryptPKCS8/testdata/openssl.rsa1024.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/openssh.p384.pem
 === CONT  TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/openssl.p256.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem
 === CONT  TestEncryptDecryptPKCS8/testdata/openssh.p521.pem
 === CONT  TestEncryptDecryptPKCS8/testdata/openssh.p256.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.ed25519.pem
 === CONT  TestEncryptDecryptPKCS8/testdata/openssl.p384.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/openssl.p521.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/openssh.p384.pem
-=== CONT  TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem
-=== RUN   TestOpenSSH/testdata/openssh.rsa2048.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssh.rsa2048.enc.pem
 === RUN   TestOpenSSH/testdata/openssh.ed25519.enc.pem
 === PAUSE TestOpenSSH/testdata/openssh.ed25519.enc.pem
-=== RUN   TestOpenSSH/testdata/cosign.enc.pem
-=== PAUSE TestOpenSSH/testdata/cosign.enc.pem
-=== RUN   TestOpenSSH/testdata/openssl.p384.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssl.p384.enc.pem
-=== RUN   TestOpenSSH/testdata/openssh.p256.pem
-=== PAUSE TestOpenSSH/testdata/openssh.p256.pem
-=== RUN   TestOpenSSH/testdata/openssh.p256.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssh.p256.enc.pem
-=== RUN   TestOpenSSH/testdata/openssh.rsa1024.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssh.rsa1024.enc.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem
-=== RUN   TestOpenSSH/testdata/openssh.p521.pem
-=== PAUSE TestOpenSSH/testdata/openssh.p521.pem
-=== RUN   TestOpenSSH/testdata/openssh.p521.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssh.p521.enc.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p521.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p521.pem
+=== RUN   TestOpenSSH/testdata/openssl.rsa2048.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssl.rsa2048.enc.pem
+=== RUN   TestOpenSSH/testdata/openssl.p521.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssl.p521.enc.pem
+=== RUN   TestOpenSSH/testdata/openssl.rsa1024.pem
+=== PAUSE TestOpenSSH/testdata/openssl.rsa1024.pem
 === RUN   TestOpenSSH/testdata/pkcs8/openssl.p256.enc.pem
 === PAUSE TestOpenSSH/testdata/pkcs8/openssl.p256.enc.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem
-=== RUN   TestOpenSSH/testdata/openssh.ed25519.pem
-=== PAUSE TestOpenSSH/testdata/openssh.ed25519.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem
 === RUN   TestOpenSSH/testdata/openssl.p256.pem
 === PAUSE TestOpenSSH/testdata/openssl.p256.pem
-=== RUN   TestOpenSSH/testdata/openssl.rsa2048.enc.pem
-=== PAUSE TestOpenSSH/testdata/openssl.rsa2048.enc.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/openssl.p521.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem
+=== CONT  TestEncryptDecryptPKCS8/testdata/openssl.p256.pem
 === RUN   TestOpenSSH/testdata/pkcs8/openssl.ed25519.enc.pem
 === PAUSE TestOpenSSH/testdata/pkcs8/openssl.ed25519.enc.pem
-=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem
-=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem
+=== RUN   TestOpenSSH/testdata/openssh.p256.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssh.p256.enc.pem
 === RUN   TestOpenSSH/testdata/openssh.rsa1024.pem
 === PAUSE TestOpenSSH/testdata/openssh.rsa1024.pem
+=== RUN   TestOpenSSH/testdata/openssl.rsa1024.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssl.rsa1024.enc.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem
+=== RUN   TestOpenSSH/testdata/openssh.p256.pem
+=== PAUSE TestOpenSSH/testdata/openssh.p256.pem
+=== RUN   TestOpenSSH/testdata/openssh.p521.pem
+=== PAUSE TestOpenSSH/testdata/openssh.p521.pem
+=== RUN   TestOpenSSH/testdata/openssl.p384.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssl.p384.enc.pem
+=== RUN   TestOpenSSH/testdata/cosign.enc.pem
+=== PAUSE TestOpenSSH/testdata/cosign.enc.pem
+=== RUN   TestOpenSSH/testdata/openssh.rsa2048.enc.pem
+=== PAUSE TestOpenSSH/testdata/openssh.rsa2048.enc.pem
 === RUN   TestOpenSSH/testdata/openssl.p256.enc.pem
 === PAUSE TestOpenSSH/testdata/openssl.p256.enc.pem
-=== RUN   TestOpenSSH/testdata/openssl.rsa1024.pem
-=== PAUSE TestOpenSSH/testdata/openssl.rsa1024.pem
-=== CONT  TestOpenSSH/testdata/openssl.rsa1024.enc.pem
-=== CONT  TestOpenSSH/testdata/openssh.p256.pem
-=== CONT  TestOpenSSH/testdata/openssh.ed25519.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p256.pem
-=== CONT  TestOpenSSH/testdata/openssl.rsa2048.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p384.pem
-=== CONT  TestOpenSSH/testdata/openssh.rsa2048.enc.pem
+=== RUN   TestOpenSSH/testdata/openssh.ed25519.pem
+=== PAUSE TestOpenSSH/testdata/openssh.ed25519.pem
+=== RUN   TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem
+=== PAUSE TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem
+=== CONT  TestOpenSSH/testdata/openssh.p384.enc.pem
 === CONT  TestOpenSSH/testdata/openssl.rsa1024.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem
+=== CONT  TestOpenSSH/testdata/openssl.p521.enc.pem
+=== CONT  TestOpenSSH/testdata/openssh.ed25519.pem
 === CONT  TestOpenSSH/testdata/openssl.p256.enc.pem
-=== CONT  TestOpenSSH/testdata/openssl.p521.pem
-=== CONT  TestOpenSSH/testdata/openssl.p384.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.ed25519.enc.pem
-=== CONT  TestOpenSSH/testdata/openssh.p384.enc.pem
+=== CONT  TestOpenSSH/testdata/openssh.rsa2048.enc.pem
+=== CONT  TestOpenSSH/testdata/cosign.enc.pem
+=== CONT  TestOpenSSH/testdata/openssl.p384.enc.pem
+=== CONT  TestOpenSSH/testdata/openssh.p521.pem
+=== CONT  TestOpenSSH/testdata/openssh.p256.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem
+=== CONT  TestOpenSSH/testdata/openssl.rsa1024.enc.pem
 === CONT  TestOpenSSH/testdata/openssh.rsa1024.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p521.pem
-=== CONT  TestOpenSSH/testdata/openssl.p521.enc.pem
+=== CONT  TestOpenSSH/testdata/openssh.p256.enc.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.ed25519.enc.pem
+=== CONT  TestOpenSSH/testdata/openssl.p256.pem
 === CONT  TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem
-=== CONT  TestOpenSSH/testdata/openssl.rsa2048.enc.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem
-=== CONT  TestOpenSSH/testdata/openssh.p521.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem
 === CONT  TestOpenSSH/testdata/pkcs8/openssl.p256.enc.pem
+=== CONT  TestOpenSSH/testdata/openssl.rsa2048.enc.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p521.pem
+=== CONT  TestOpenSSH/testdata/openssh.ed25519.enc.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p384.pem
+=== CONT  TestOpenSSH/testdata/openssh.p521.enc.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem
+=== CONT  TestOpenSSH/testdata/openssl.p384.pem
+=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p256.pem
 === CONT  TestOpenSSH/testdata/openssh.rsa1024.enc.pem
-=== CONT  TestOpenSSH/testdata/openssh.p256.enc.pem
+=== CONT  TestOpenSSH/testdata/openssl.rsa2048.pem
+=== CONT  TestOpenSSH/testdata/openssl.p521.pem
 === CONT  TestOpenSSH/testdata/openssh.rsa2048.pem
-=== CONT  TestOpenSSH/testdata/cosign.enc.pem
-=== CONT  TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem
 === CONT  TestOpenSSH/testdata/openssh.p384.pem
-=== CONT  TestOpenSSH/testdata/openssl.p256.pem
-=== CONT  TestOpenSSH/testdata/openssh.ed25519.enc.pem
-=== CONT  TestOpenSSH/testdata/openssl.p384.enc.pem
-=== CONT  TestOpenSSH/testdata/openssh.p521.enc.pem
---- PASS: TestOpenSSH (0.01s)
-    --- PASS: TestOpenSSH/testdata/openssh.p256.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/openssh.ed25519.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p256.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
+--- PASS: TestEncryptDecryptPKCS8 (0.00s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.p256.pem (1.97s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.p521.pem (2.08s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.rsa1024.pem (2.13s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem (2.19s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem (2.23s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.p521.pem (2.26s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.p384.pem (2.35s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem (2.37s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.p256.pem (2.31s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.ed25519.pem (2.45s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem (2.50s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem (2.53s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem (2.57s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem (2.50s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem (2.53s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.p384.pem (2.79s)
+    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem (2.78s)
+--- PASS: TestOpenSSH (0.10s)
     --- PASS: TestOpenSSH/testdata/openssl.rsa1024.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/openssl.rsa2048.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p384.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/openssl.p521.enc.pem (1.12s)
+    --- PASS: TestOpenSSH/testdata/openssh.ed25519.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem (1.33s)
+    --- PASS: TestOpenSSH/testdata/openssh.p384.enc.pem (1.38s)
+    --- PASS: TestOpenSSH/testdata/openssh.p521.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/openssh.p256.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem (0.01s)
     --- PASS: TestOpenSSH/testdata/openssh.rsa1024.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/openssl.p256.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem (0.01s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p521.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p384.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/openssl.p256.enc.pem (1.22s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.rsa2048.pem (0.00s)
     --- PASS: TestOpenSSH/testdata/openssl.p384.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.ed25519.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.rsa4096.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p256.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/openssl.rsa2048.pem (0.00s)
     --- PASS: TestOpenSSH/testdata/openssl.p521.pem (0.01s)
-    --- PASS: TestOpenSSH/testdata/openssh.p384.pem (0.00s)
-    --- PASS: TestOpenSSH/testdata/openssl.p256.pem (0.01s)
-    --- PASS: TestOpenSSH/testdata/openssh.rsa2048.pem (0.02s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p521.pem (0.02s)
-    --- PASS: TestOpenSSH/testdata/openssh.p521.pem (0.02s)
-    --- PASS: TestOpenSSH/testdata/openssl.p256.enc.pem (0.66s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem (0.66s)
-    --- PASS: TestOpenSSH/testdata/openssl.p521.enc.pem (0.66s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.ed25519.enc.pem (0.67s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem (0.68s)
-    --- PASS: TestOpenSSH/testdata/openssl.rsa1024.enc.pem (0.68s)
-    --- PASS: TestOpenSSH/testdata/openssl.p384.enc.pem (0.66s)
-    --- PASS: TestOpenSSH/testdata/openssl.rsa2048.enc.pem (0.69s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p256.enc.pem (0.70s)
-    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p521.enc.pem (0.71s)
-    --- PASS: TestOpenSSH/testdata/openssh.rsa2048.enc.pem (0.81s)
-    --- PASS: TestOpenSSH/testdata/openssh.ed25519.enc.pem (0.81s)
-    --- PASS: TestOpenSSH/testdata/openssh.p384.enc.pem (0.83s)
-    --- PASS: TestOpenSSH/testdata/cosign.enc.pem (0.84s)
-    --- PASS: TestOpenSSH/testdata/openssh.p256.enc.pem (0.84s)
-    --- PASS: TestOpenSSH/testdata/openssh.rsa1024.enc.pem (0.84s)
-    --- PASS: TestOpenSSH/testdata/openssh.p521.enc.pem (0.88s)
---- PASS: TestEncryptDecryptPKCS8 (0.00s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.p256.pem (0.92s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.rsa1024.pem (0.98s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.p384.pem (1.00s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.rsa2048.pem (1.03s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa4096.pem (1.03s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.ed25519.pem (1.03s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.rsa2048.pem (1.04s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.p521.pem (1.04s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.rsa1024.pem (1.05s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.rsa2048.pem (1.06s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p384.pem (1.07s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.p521.pem (1.07s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.ed25519.pem (1.09s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p256.pem (1.11s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssh.p256.pem (1.11s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/openssl.p384.pem (1.13s)
-    --- PASS: TestEncryptDecryptPKCS8/testdata/pkcs8/openssl.p521.pem (1.15s)
+    --- PASS: TestOpenSSH/testdata/openssh.rsa2048.pem (0.00s)
+    --- PASS: TestOpenSSH/testdata/openssh.p384.pem (0.01s)
+    --- PASS: TestOpenSSH/testdata/openssh.rsa2048.enc.pem (1.35s)
+    --- PASS: TestOpenSSH/testdata/openssl.p384.enc.pem (0.87s)
+    --- PASS: TestOpenSSH/testdata/openssl.rsa1024.enc.pem (0.80s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.ed25519.enc.pem (0.82s)
+    --- PASS: TestOpenSSH/testdata/cosign.enc.pem (1.63s)
+    --- PASS: TestOpenSSH/testdata/openssh.p256.enc.pem (1.01s)
+    --- PASS: TestOpenSSH/testdata/openssl.rsa2048.enc.pem (0.85s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.rsa2048.enc.pem (0.84s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p384.enc.pem (0.76s)
+    --- PASS: TestOpenSSH/testdata/pkcs8/openssl.p256.enc.pem (1.03s)
+    --- PASS: TestOpenSSH/testdata/openssh.ed25519.enc.pem (1.01s)
+    --- PASS: TestOpenSSH/testdata/openssh.rsa1024.enc.pem (0.99s)
+    --- PASS: TestOpenSSH/testdata/openssh.p521.enc.pem (1.09s)
 PASS
-ok  	go.step.sm/crypto/pemutil	6.688s
+ok  	go.step.sm/crypto/pemutil	11.380s
 === RUN   TestErrors
 --- PASS: TestErrors (0.00s)
 === RUN   TestSalt
@@ -2520,7 +2556,7 @@
     --- PASS: TestUUIDv4/ok#01 (0.00s)
     --- PASS: TestUUIDv4/fail (0.00s)
 PASS
-ok  	go.step.sm/crypto/randutil	0.006s
+ok  	go.step.sm/crypto/randutil	0.012s
 === RUN   TestNewCertificate
 === RUN   TestNewCertificate/user
 === RUN   TestNewCertificate/host
@@ -2533,7 +2569,7 @@
 === RUN   TestNewCertificate/badFileTemplate
 === RUN   TestNewCertificate/badJsonTemplate
 === RUN   TestNewCertificate/failTemplate
---- PASS: TestNewCertificate (0.00s)
+--- PASS: TestNewCertificate (0.01s)
     --- PASS: TestNewCertificate/user (0.00s)
     --- PASS: TestNewCertificate/host (0.00s)
     --- PASS: TestNewCertificate/host_escape (0.00s)
@@ -2558,9 +2594,9 @@
 === RUN   TestCreateCertificate/emptySerial
 === RUN   TestCreateCertificate/fail_signer.Sign
 === RUN   TestCreateCertificate/fail_signer.SignWithAlgorithm
---- PASS: TestCreateCertificate (0.24s)
+--- PASS: TestCreateCertificate (0.43s)
     --- PASS: TestCreateCertificate/ok (0.00s)
-    --- PASS: TestCreateCertificate/ok_rsa (0.00s)
+    --- PASS: TestCreateCertificate/ok_rsa (0.01s)
     --- PASS: TestCreateCertificate/emptyNonce (0.00s)
     --- PASS: TestCreateCertificate/emptySerial (0.00s)
     --- PASS: TestCreateCertificate/fail_signer.Sign (0.00s)
@@ -2572,7 +2608,7 @@
 === RUN   TestFingerprint/ok_SK-ECDSA
 === RUN   TestFingerprint/ok_SK-ED25519
 === RUN   TestFingerprint/ok_CERT
---- PASS: TestFingerprint (0.20s)
+--- PASS: TestFingerprint (0.94s)
     --- PASS: TestFingerprint/ok_ECDSA (0.00s)
     --- PASS: TestFingerprint/ok_ED25519 (0.00s)
     --- PASS: TestFingerprint/ok_RSA (0.00s)
@@ -2615,7 +2651,7 @@
 === RUN   TestFormatFingerprint/EmojiFingerprint
 === RUN   TestFormatFingerprint/fail_input
 === RUN   TestFormatFingerprint/fail_encoding
---- PASS: TestFormatFingerprint (0.38s)
+--- PASS: TestFormatFingerprint (0.71s)
     --- PASS: TestFormatFingerprint/P256 (0.00s)
     --- PASS: TestFormatFingerprint/P384 (0.00s)
     --- PASS: TestFormatFingerprint/P521 (0.00s)
@@ -2682,7 +2718,7 @@
 === RUN   TestCryptoPublicKey/fail_agent
 === RUN   TestCryptoPublicKey/fail_type
 === RUN   TestCryptoPublicKey/fail_sk
---- PASS: TestCryptoPublicKey (0.30s)
+--- PASS: TestCryptoPublicKey (0.41s)
     --- PASS: TestCryptoPublicKey/ok_ec (0.00s)
     --- PASS: TestCryptoPublicKey/ok_Ed25519 (0.00s)
     --- PASS: TestCryptoPublicKey/ok_rsa (0.00s)
@@ -2884,7 +2920,7 @@
     --- PASS: TestCertType_UnmarshalJSON/object (0.00s)
     --- PASS: TestCertType_UnmarshalJSON/badJSON (0.00s)
 PASS
-ok  	go.step.sm/crypto/sshutil	1.137s
+ok  	go.step.sm/crypto/sshutil	2.532s
 === RUN   Test_newCredentialsCache
 === RUN   Test_newCredentialsCache/ok
 --- PASS: Test_newCredentialsCache (0.00s)
@@ -2937,8 +2973,8 @@
 === RUN   TestRenewer_GetCertificate/ok
 === RUN   TestRenewer_GetCertificate/fail_empty
 === RUN   TestRenewer_GetCertificate/fail_httptest
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:38666: remote error: tls: bad certificate
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:38668: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:42984: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:42986: remote error: tls: bad certificate
 --- PASS: TestRenewer_GetCertificate (0.01s)
     --- PASS: TestRenewer_GetCertificate/ok (0.00s)
     --- PASS: TestRenewer_GetCertificate/fail_empty (0.00s)
@@ -2946,11 +2982,11 @@
 === RUN   TestRenewer_GetClientCertificate
 === RUN   TestRenewer_GetClientCertificate/ok
 === RUN   TestRenewer_GetClientCertificate/fail_no_cert
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:55550: tls: client didn't provide a certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:34034: tls: client didn't provide a certificate
 === RUN   TestRenewer_GetClientCertificate/fail_empty
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:55558: remote error: tls: bad certificate
 === RUN   TestRenewer_GetClientCertificate/fail_httptest
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:55562: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:34038: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:34046: remote error: tls: bad certificate
 --- PASS: TestRenewer_GetClientCertificate (0.01s)
     --- PASS: TestRenewer_GetClientCertificate/ok (0.00s)
     --- PASS: TestRenewer_GetClientCertificate/fail_no_cert (0.00s)
@@ -2958,13 +2994,13 @@
     --- PASS: TestRenewer_GetClientCertificate/fail_httptest (0.00s)
 === RUN   TestRenewer_RenewFunc_error
 === RUN   TestRenewer_RenewFunc_error/fail_GetCertificate
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:47116: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:39150: remote error: tls: bad certificate
 === RUN   TestRenewer_RenewFunc_error/fail_GetConfigForClient
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:57614: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-03-12T18:01:32-12:00 is after 2026-03-13T06:01:32Z
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:42416: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-02-08T13:42:02+14:00 is after 2025-02-07T23:42:02Z
 === RUN   TestRenewer_RenewFunc_error/fail_GetClientCertificate
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:50824: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-03-12T18:01:32-12:00 is after 2026-03-13T06:01:32Z
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:48378: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-02-08T13:42:02+14:00 is after 2025-02-07T23:42:02Z
 --- PASS: TestRenewer_RenewFunc_error (0.01s)
-    --- PASS: TestRenewer_RenewFunc_error/fail_GetCertificate (0.00s)
+    --- PASS: TestRenewer_RenewFunc_error/fail_GetCertificate (0.01s)
     --- PASS: TestRenewer_RenewFunc_error/fail_GetConfigForClient (0.00s)
     --- PASS: TestRenewer_RenewFunc_error/fail_GetClientCertificate (0.00s)
 === RUN   TestNewServerCredentials
@@ -2980,13 +3016,13 @@
 === RUN   TestServerCredentials_GetCertificate
 === RUN   TestServerCredentials_GetCertificate/ok
 === RUN   TestServerCredentials_GetCertificate/fail_empty
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:40376: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:39464: remote error: tls: bad certificate
 === RUN   TestServerCredentials_GetCertificate/fail_httptest
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:40384: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:39476: remote error: tls: bad certificate
 === RUN   TestServerCredentials_GetCertificate/fail_ip
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:40392: server name indication cannot be empty
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:39482: server name indication cannot be empty
 === RUN   TestServerCredentials_GetCertificate/fail_httptest_ip
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:40404: server name indication cannot be empty
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:39490: server name indication cannot be empty
 --- PASS: TestServerCredentials_GetCertificate (0.01s)
     --- PASS: TestServerCredentials_GetCertificate/ok (0.00s)
     --- PASS: TestServerCredentials_GetCertificate/fail_empty (0.00s)
@@ -2996,13 +3032,13 @@
 === RUN   TestServerCredentials_GetConfigForClient
 === RUN   TestServerCredentials_GetConfigForClient/ok
 === RUN   TestServerCredentials_GetConfigForClient/fail_empty
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:34526: remote error: tls: bad certificate
 === RUN   TestServerCredentials_GetConfigForClient/fail_httptest
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:34538: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:59764: remote error: tls: bad certificate
 === RUN   TestServerCredentials_GetConfigForClient/fail_ip
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:34548: server name indication cannot be empty
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:59768: remote error: tls: bad certificate
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:59774: server name indication cannot be empty
 === RUN   TestServerCredentials_GetConfigForClient/fail_httptest_ip
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:34562: server name indication cannot be empty
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:59782: server name indication cannot be empty
 --- PASS: TestServerCredentials_GetConfigForClient (0.01s)
     --- PASS: TestServerCredentials_GetConfigForClient/ok (0.00s)
     --- PASS: TestServerCredentials_GetConfigForClient/fail_empty (0.00s)
@@ -3011,11 +3047,11 @@
     --- PASS: TestServerCredentials_GetConfigForClient/fail_httptest_ip (0.00s)
 === RUN   TestServerCredentials_RenewFunc_error
 === RUN   TestServerCredentials_RenewFunc_error/fail_GetCertificate
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:33288: test error
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:60950: test error
 === RUN   TestServerCredentials_RenewFunc_error/fail_GetConfigForClient
-2026/03/12 18:01:32 http: TLS handshake error from 127.0.0.1:53824: test error
---- PASS: TestServerCredentials_RenewFunc_error (0.00s)
-    --- PASS: TestServerCredentials_RenewFunc_error/fail_GetCertificate (0.00s)
+2025/02/08 13:42:02 http: TLS handshake error from 127.0.0.1:38258: test error
+--- PASS: TestServerCredentials_RenewFunc_error (0.01s)
+    --- PASS: TestServerCredentials_RenewFunc_error/fail_GetCertificate (0.01s)
     --- PASS: TestServerCredentials_RenewFunc_error/fail_GetConfigForClient (0.00s)
 === RUN   TestServerCredentials_TLSConfig
 === RUN   TestServerCredentials_TLSConfig/ok
@@ -3050,17 +3086,17 @@
     --- PASS: TestSanitizeHost/fail_empty (0.00s)
     --- PASS: TestSanitizeHost/fail_empty_with_port (0.00s)
 PASS
-ok  	go.step.sm/crypto/tlsutil	4.051s
+ok  	go.step.sm/crypto/tlsutil	4.080s
 === RUN   TestVectors
 === RUN   TestVectors/ok
 === RUN   TestVectors/ok#01
 === RUN   TestVectors/ok#02
---- PASS: TestVectors (0.00s)
-    --- PASS: TestVectors/ok (0.00s)
+--- PASS: TestVectors (0.01s)
+    --- PASS: TestVectors/ok (0.01s)
     --- PASS: TestVectors/ok#01 (0.00s)
     --- PASS: TestVectors/ok#02 (0.00s)
 === RUN   TestSignVerify
---- PASS: TestSignVerify (0.35s)
+--- PASS: TestSignVerify (0.86s)
 === RUN   TestGenerateKey
 === RUN   TestGenerateKey/ok
 === RUN   TestGenerateKey/fail
@@ -3102,7 +3138,7 @@
     --- PASS: TestVerify_error/fail (0.00s)
     --- PASS: TestVerify_error/panic (0.00s)
 PASS
-ok  	go.step.sm/crypto/x25519	0.355s
+ok  	go.step.sm/crypto/x25519	0.877s
 === RUN   TestSignatureAlgorithm_Set
 === RUN   TestSignatureAlgorithm_Set/ok
 === RUN   TestSignatureAlgorithm_Set/ok#01
@@ -3202,7 +3238,7 @@
 === RUN   TestNewCertificateRequest/fail_apply
 === RUN   TestNewCertificateRequest/fail_unmarshal
 === RUN   TestNewCertificateRequest/fail_extended_sans
---- PASS: TestNewCertificateRequest (0.00s)
+--- PASS: TestNewCertificateRequest (0.01s)
     --- PASS: TestNewCertificateRequest/ok_simple (0.00s)
     --- PASS: TestNewCertificateRequest/ok_default (0.00s)
     --- PASS: TestNewCertificateRequest/ok_extended_sans (0.00s)
@@ -3251,7 +3287,7 @@
 === RUN   TestNewCertificate/missingTemplate
 === RUN   TestNewCertificate/badJson
 === RUN   TestNewCertificate/failCustomSANs
---- PASS: TestNewCertificate (0.00s)
+--- PASS: TestNewCertificate (0.01s)
     --- PASS: TestNewCertificate/okSimple (0.00s)
     --- PASS: TestNewCertificate/okDefaultTemplate (0.00s)
     --- PASS: TestNewCertificate/okCustomSANs (0.00s)
@@ -3274,7 +3310,7 @@
 === RUN   TestCreateCertificate/okNothing
 === RUN   TestCreateCertificate/failSubjectKeyID
 === RUN   TestCreateCertificate/failSign
---- PASS: TestCreateCertificate (0.00s)
+--- PASS: TestCreateCertificate (0.01s)
     --- PASS: TestCreateCertificate/ok (0.00s)
     --- PASS: TestCreateCertificate/okNoSubjectKeyID (0.00s)
     --- PASS: TestCreateCertificate/okNoSerialNumber (0.00s)
@@ -3303,41 +3339,41 @@
 === RUN   TestCreateCertificate_debug/directoryName
     certificate_test.go:650: 
         -----BEGIN CERTIFICATE-----
-        MIIBlDCCAUagAwIBAgIRAIiZbFSAblTCdxe+FS0cSwEwBQYDK2VwMBExDzANBgNV
-        BAMTBmlzc3VlcjAiGA8wMDAxMDEwMTAwMDAwMFoYDzAwMDEwMTAxMDAwMDAwWjAR
-        MQ8wDQYDVQQDEwZyb2NrZXQwKjAFBgMrZXADIQDjJJ7dl3NGQd2sJtz6SkU0Dhk2
-        4AtGPgjHuBoQLh+n7aOBrjCBqzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYI
-        KwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTTmOGamFVWE7jO2rFb4Ief+06X
-        qTAfBgNVHSMEGDAWgBRCfKWLZxXeuKz3f7q8m/ZSzPmXtDA6BgNVHREEMzAxpC8w
-        LTELMAkGA1UEBhMCVVMxDTALBgNVBAoTBEFDTUUxDzANBgNVBAMTBnJvY2tldDAF
-        BgMrZXADQQAO0XEo0ZTqtPj8odN/mb4yEeKPqhSHWb7PPf/w1C/QutbX/TNaTebY
-        JxqH3REWMCNlr1fGyfmAMwIjM3EDREsJ
+        MIIBkzCCAUWgAwIBAgIQYKsZYEructgWDceSPfAd9zAFBgMrZXAwETEPMA0GA1UE
+        AxMGaXNzdWVyMCIYDzAwMDEwMTAxMDAwMDAwWhgPMDAwMTAxMDEwMDAwMDBaMBEx
+        DzANBgNVBAMTBnJvY2tldDAqMAUGAytlcAMhAIXuKRMOmcuc9JZzEdUH2dcZtYNv
+        qt5gELUaUYTzn6ego4GuMIGrMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggr
+        BgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFOU/O/xtwhtJ0OvBrP0c5pGr72Yl
+        MB8GA1UdIwQYMBaAFOEZcafrIjWeq599kWXDRqjmRT0/MDoGA1UdEQQzMDGkLzAt
+        MQswCQYDVQQGEwJVUzENMAsGA1UEChMEQUNNRTEPMA0GA1UEAxMGcm9ja2V0MAUG
+        AytlcANBAGLR8aoUCEy5ZU591BH82E1IbzKXSQIbEGiDykSzsZd87ZvS1stHJteM
+        z5VGwb9h/YGINeT+M765XZLIQgZ8Zg0=
         -----END CERTIFICATE-----
 === RUN   TestCreateCertificate_debug/hardwareModuleName
     certificate_test.go:650: 
         -----BEGIN CERTIFICATE-----
-        MIIBhDCCATagAwIBAgIRALaFlqazA7VRTQUVs+yurZYwBQYDK2VwMBExDzANBgNV
+        MIIBhDCCATagAwIBAgIRAOo8RrsjMjBsmb6a22zrYgcwBQYDK2VwMBExDzANBgNV
         BAMTBmlzc3VlcjAiGA8wMDAxMDEwMTAwMDAwMFoYDzAwMDEwMTAxMDAwMDAwWjAR
-        MQ8wDQYDVQQDEwZyb2NrZXQwKjAFBgMrZXADIQDjJJ7dl3NGQd2sJtz6SkU0Dhk2
-        4AtGPgjHuBoQLh+n7aOBnjCBmzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYI
-        KwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTTmOGamFVWE7jO2rFb4Ief+06X
-        qTAfBgNVHSMEGDAWgBRCfKWLZxXeuKz3f7q8m/ZSzPmXtDAqBgNVHREEIzAhoB8G
-        CCsGAQUFBwgEoBMwEQYDKgMEhAowMTIzNDU2Nzg5MAUGAytlcANBAAyueEy+O0TY
-        F21snhPmGHDGtf1RTmF6L+M4AOshyq8zV1BEOdfR3B2cUmPNU0bW2TK82W3XFLXM
-        8iD8gO6VxwY=
+        MQ8wDQYDVQQDEwZyb2NrZXQwKjAFBgMrZXADIQCF7ikTDpnLnPSWcxHVB9nXGbWD
+        b6reYBC1GlGE85+noKOBnjCBmzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYI
+        KwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTlPzv8bcIbSdDrwaz9HOaRq+9m
+        JTAfBgNVHSMEGDAWgBThGXGn6yI1nquffZFlw0ao5kU9PzAqBgNVHREEIzAhoB8G
+        CCsGAQUFBwgEoBMwEQYDKgMEhAowMTIzNDU2Nzg5MAUGAytlcANBAHleq1osf4bz
+        Hp2pcf+tJi2NswtGM5VVRVL/EEXaG8LSpvan6Xka8hv02wL01Wa5FonkDF2QXrsY
+        +lHAeNokbAw=
         -----END CERTIFICATE-----
 === RUN   TestCreateCertificate_debug/permanentIdentifier
     certificate_test.go:650: 
         -----BEGIN CERTIFICATE-----
-        MIIBhDCCATagAwIBAgIRAMSh6CqfhPMWLXtcCvnury8wBQYDK2VwMBExDzANBgNV
-        BAMTBmlzc3VlcjAiGA8wMDAxMDEwMTAwMDAwMFoYDzAwMDEwMTAxMDAwMDAwWjAR
-        MQ8wDQYDVQQDEwZyb2NrZXQwKjAFBgMrZXADIQDjJJ7dl3NGQd2sJtz6SkU0Dhk2
-        4AtGPgjHuBoQLh+n7aOBnjCBmzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYI
-        KwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTTmOGamFVWE7jO2rFb4Ief+06X
-        qTAfBgNVHSMEGDAWgBRCfKWLZxXeuKz3f7q8m/ZSzPmXtDAqBgNVHREEIzAhoB8G
-        CCsGAQUFBwgDoBMwEQwKMDEyMzQ1Njc4OQYDKgMEMAUGAytlcANBAD1vjaYwmJDa
-        0GxyHfhcG1yrMGBhk0Sk9eVK+FYHfFbtZ92ykp/VuFktmI+TLsVPU2EWWoxWrNeu
-        1rC8zyVNVQc=
+        MIIBgzCCATWgAwIBAgIQIi40g7Lp4uZrP6CkPa2vbDAFBgMrZXAwETEPMA0GA1UE
+        AxMGaXNzdWVyMCIYDzAwMDEwMTAxMDAwMDAwWhgPMDAwMTAxMDEwMDAwMDBaMBEx
+        DzANBgNVBAMTBnJvY2tldDAqMAUGAytlcAMhAIXuKRMOmcuc9JZzEdUH2dcZtYNv
+        qt5gELUaUYTzn6ego4GeMIGbMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggr
+        BgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFOU/O/xtwhtJ0OvBrP0c5pGr72Yl
+        MB8GA1UdIwQYMBaAFOEZcafrIjWeq599kWXDRqjmRT0/MCoGA1UdEQQjMCGgHwYI
+        KwYBBQUHCAOgEzARDAowMTIzNDU2Nzg5BgMqAwQwBQYDK2VwA0EAL9Z3jkeOHMwT
+        WLQXPMxbsYZntAm0tIE0szAMZuJidRdSwlVH8LFEzy9UDo8P8klABKOeMvC+1ObF
+        3I/h6KyADg==
         -----END CERTIFICATE-----
 --- PASS: TestCreateCertificate_debug (0.00s)
     --- PASS: TestCreateCertificate_debug/directoryName (0.00s)
@@ -3509,7 +3545,7 @@
 === RUN   TestSubjectAlternativeName_RawValue/fail_otherName_printable
 === RUN   TestSubjectAlternativeName_RawValue/fail_otherName_default
 === RUN   TestSubjectAlternativeName_RawValue/fail_otherName_no_type
---- PASS: TestSubjectAlternativeName_RawValue (0.00s)
+--- PASS: TestSubjectAlternativeName_RawValue (0.01s)
     --- PASS: TestSubjectAlternativeName_RawValue/ip (0.00s)
     --- PASS: TestSubjectAlternativeName_RawValue/ipv6 (0.00s)
     --- PASS: TestSubjectAlternativeName_RawValue/uri (0.00s)
@@ -4187,7 +4223,7 @@
 === RUN   TestWithTemplate/adminRSA
 === RUN   TestWithTemplate/fail
 === RUN   TestWithTemplate/error
---- PASS: TestWithTemplate (0.20s)
+--- PASS: TestWithTemplate (0.60s)
     --- PASS: TestWithTemplate/leaf (0.00s)
     --- PASS: TestWithTemplate/leafRSA (0.00s)
     --- PASS: TestWithTemplate/iid (0.00s)
@@ -4208,7 +4244,7 @@
 === RUN   TestWithTemplateFile/exampleRSA3072
 === RUN   TestWithTemplateFile/exampleRSA2048
 === RUN   TestWithTemplateFile/missing
---- PASS: TestWithTemplateFile (0.72s)
+--- PASS: TestWithTemplateFile (1.20s)
     --- PASS: TestWithTemplateFile/example (0.00s)
     --- PASS: TestWithTemplateFile/exampleRSA3072 (0.00s)
     --- PASS: TestWithTemplateFile/exampleRSA2048 (0.00s)
@@ -4370,7 +4406,7 @@
     --- PASS: TestSanitizeName/fail_with_port (0.00s)
     --- PASS: TestSanitizeName/fail_empty (0.00s)
 PASS
-ok  	go.step.sm/crypto/x509util	0.966s
+ok  	go.step.sm/crypto/x509util	1.884s
    create-stamp debian/debhelper-build-stamp
    dh_testroot -O--builddirectory=_build -O--buildsystem=golang
    dh_prep -O--builddirectory=_build -O--buildsystem=golang
@@ -4398,12 +4434,14 @@
 dpkg-buildpackage: info: binary-only upload (no source included)
 dpkg-genchanges: info: not including original source code in upload
 I: copying local configuration
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/B01_cleanup starting
+I: user script /srv/workspace/pbuilder/3248060/tmp/hooks/B01_cleanup finished
 I: unmounting dev/ptmx filesystem
 I: unmounting dev/pts filesystem
 I: unmounting dev/shm filesystem
 I: unmounting proc filesystem
 I: unmounting sys filesystem
 I: cleaning the build env 
-I: removing directory /srv/workspace/pbuilder/3114959 and its subdirectories
-I: Current time: Thu Mar 12 18:01:40 -12 2026
-I: pbuilder-time-stamp: 1773381700
+I: removing directory /srv/workspace/pbuilder/3248060 and its subdirectories
+I: Current time: Sat Feb  8 13:42:28 +14 2025
+I: pbuilder-time-stamp: 1738971748