I don't understand the whole data flow, so maybe I miss some code path somewhere, but it seems that the credentials I pass in ComputeServiceContext gets to OAuthCredentialsSupplier (it's bound to Supplier<OAuthCredentials>). The latter calls OAuthCredentialsForCredentials.load() -> org.jclouds.crypto.Pems.privateKeySpec() and that function doesn't seem to even support "-----BEGIN ENCRYPTED PRIVATE KEY-----"