Feels smelly but not sure what you can do.  I think part of the problem is that the client code assumes that SSH keys can be passed to Openssl and just work - maybe we should relax that a bit.  Hard to say.