Can there be a unit test that exercises the `passphrase == ""` case as well?  I can see how that might be difficult depending on how the OpenSSL `pkcs` command line works, though...