PEM Serialized Private Key Loader

If a puzzle hands you a private key in PEM form - the -----BEGIN PRIVATE KEY----- text blob that SSH keys, certificates and a hundred other things use - this is the node that turns it into an actual key object inside ComfyUI. PEMPrivateKey (display name "PEM Serialized Private Key Loader") reads those bytes and returns a KEYOBJ you can pass to the pack's asymmetric signing or decryption nodes. Without it you'd be stuck staring at a wall of base64 text with no way to use it.

Under the hood it's one call into Python's cryptography library: serialization.load_pem_private_key(). That's the same parser every serious Python tool uses, so anything that's valid PEM for OpenSSL will load here, and the error messages you get on malformed input are the familiar, slightly cryptic ones from the library.

The inputs are minimal:

• keyfile - the PEM content as bytes (BYTESLIKE). You'll usually get this by reading a .pem file with a file-loading node and letting the bytes flow in. The -----BEGIN …----- header must be part of those bytes.
• password (optional) - if the key is encrypted (a -----BEGIN ENCRYPTED PRIVATE KEY----- blob, or a traditional PEM with a password), supply it as BYTESLIKE. Leave it empty for an unencrypted key.

The output is loaded_key, type KEYOBJ - a real key object, not a string. That type is the pack's own wire format for keys, so it plugs into the pack's signing, verification and asymmetric encryption nodes. You can't just dump it to a text display; it's meant to flow forward, not be read.

Install: ComfyUI Manager → "ComfyUI ARG Toolkit" → install → restart, or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI; it's under ARG Toolkit/Cryptography/Modern/Asymmetric. No model downloads - the pack's cryptography dependency is what does the parsing.

Practical notes. First, the node loads whatever private-key format cryptography recognizes - RSA, EC, Ed25519 - but the downstream node decides what it can do with that key, so an Ed25519 key won't magically do RSA operations. Second, when you wire a password in, make sure it's the bytes of the password, not a string; the classic mistake is feeding the text directly and watching load_pem_private_key fail with a "wrong password or corrupt data" style error that's misleadingly vague. And third, the author's own caveat applies: this is an amateur project with light test coverage, so if a key that OpenSSL loads fine fails here, treat the error message as a hint about format rather than gospel - but for standard PEM, this node is solid.