public Future<String> getPrivateKey(KeeperRecord record) {

        // Attempt to find single matching keypair field
        KeyPairs keyPairsField = getField(
                record, KeyPairs.class, PRIVATE_KEY_CUSTOM_LABEL_PATTERN);
        if (keyPairsField != null) {
            String privateKey = getSingleStringValue(keyPairsField.getValue(), KeyPair::getPrivateKey);
            if (privateKey != null && !privateKey.isEmpty())
                return CompletableFuture.completedFuture(privateKey);
        }

        // Lacking a typed keypair field, prefer a PEM-type attachment
        KeeperFile keyFile = getFile(record, PRIVATE_KEY_FILENAME_PATTERN);
        if (keyFile != null)
            return download(keyFile);

        KeeperRecordData data = record.getData();
        List<KeeperRecordField> custom = data.getCustom();

        // Use a hidden "private pem key" standard field as fallback ...
        HiddenField hiddenField = getField(
                data.getFields(), HiddenField.class, PRIVATE_KEY_STANDARD_LABEL_PATTERN);
        if (hiddenField != null)
            return CompletableFuture.completedFuture(getSingleStringValue(hiddenField.getValue()));

        // ... or password "private key" custom field ...
        Password passwordField = getField(
                custom, Password.class, PRIVATE_KEY_CUSTOM_LABEL_PATTERN);
        if (passwordField != null)
            return CompletableFuture.completedFuture(getSingleStringValue(passwordField.getValue()));

        // ... or hidden "private key" custom field
        hiddenField = getField(
                custom, HiddenField.class, PRIVATE_KEY_CUSTOM_LABEL_PATTERN);
        if (hiddenField != null)
            return CompletableFuture.completedFuture(getSingleStringValue(hiddenField.getValue()));

        return CompletableFuture.completedFuture(null);

    }
Returns the private key associated with the given record. If the record
has no associated private key, or multiple private keys, null is
returned. Private keys are retrieved from "KeyPairs" fields.
Alternatively, private keys are retrieved from PEM-type attachments or
standard "Hidden" fields with the label "private pem key", or custom
fields with the label "private key" if they are "KeyPairs", "Password",
or "Hidden" fields. All label matching is case-insensitive, with spaces
between words being optional. If file downloads are required, they will
be performed asynchronously.

@param record
    The record to retrieve the private key from.

@return
    A Future which resolves with the private key associated with the
    given record. If the record has no associated private key or
    multiple private keys, the returned Future will resolve to null.
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java