If users need to use `isinstance` then you still need to say what types you might return so they might know what types they need to check instanceness of.

However, interfaces that require the user to call `isinstance` seem like a cop-out to me.  Sometimes you really can't get away from it (i.e. when you have to load some JSON) but that doesn't seem like the case here.  To further the analogy to JSON, the "right" way to expose JSON-loading to *applications* is to have some kind of schema in front of the loading, so that the application only gets data in a shape that it declares it expects.  If an application needs a DSA key, it should ask for one, and if the file is in the wrong format that's an error.

Maybe this concern belongs above the hazmat layer, but definitely documenting what *might* get returned (since it's more than one thing) seems like a must.