EricLarch

sign()
  ... begin marking ...
  recover_private_key()   // function cannot be called elsewhere
    ... end marking ...
    check that it was called from sign()