Ah, thanks for the explanation. Then the condition we're looking for here is indeed `hasNonencryptedPrivateKey`. What I was trying to get at is that an encrypted private key is still _valid_ (when I hear "not valid", I'm more likely to think "corrupted", "not supported by the target system" etc.), it's just...well...encrypted.