--- /dev/null
+#!/bin/sh -eu
+tool=$(readlink -e "${0%/*}/..")
+. "$tool"/remote/lib.sh
+
+site="$1"; shift
+gpg --decrypt "$tool"/var/sec/x509/"$site"/key.pass.gpg |
+openssl rsa -passin 'stdin' \
+ -in var/sec/x509/"$site"/key.pem \
+ -out '/dev/stdout'