So the system can have multiple private keys, and the caller doesn't
need to specify a specific one regardless.
Ideally: If there are several matches we could also take into account
which keys have already been unlocked (or passthrases saved in
keychain). Right now it only grabs the first match.
