This was mostly copy+paste from the secure repo.  I'll do it the better way instead.