Reformat everything with black.

I had to undo the u string prefix removals to not drop Python 2 compatibility.
That's why black isn't enabled in antsibull-nox.toml yet.

plugins/module_utils/crypto/module_backends/privatekey.py

@@ -45,7 +45,7 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )
 
 
-MINIMAL_CRYPTOGRAPHY_VERSION = '1.2.3'
+MINIMAL_CRYPTOGRAPHY_VERSION = "1.2.3"
 
 CRYPTOGRAPHY_IMP_ERR = None
 try:
@@ -57,6 +57,7 @@ try:
     import cryptography.hazmat.primitives.asymmetric.rsa
     import cryptography.hazmat.primitives.asymmetric.utils
     import cryptography.hazmat.primitives.serialization
+
     CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
 except ImportError:
     CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
@@ -80,14 +81,14 @@ class PrivateKeyError(OpenSSLObjectError):
 class PrivateKeyBackend:
     def __init__(self, module, backend):
         self.module = module
-        self.type = module.params['type']
-        self.size = module.params['size']
-        self.curve = module.params['curve']
-        self.passphrase = module.params['passphrase']
-        self.cipher = module.params['cipher']
-        self.format = module.params['format']
-        self.format_mismatch = module.params.get('format_mismatch', 'regenerate')
-        self.regenerate = module.params.get('regenerate', 'full_idempotence')
+        self.type = module.params["type"]
+        self.size = module.params["size"]
+        self.curve = module.params["curve"]
+        self.passphrase = module.params["passphrase"]
+        self.cipher = module.params["cipher"]
+        self.format = module.params["format"]
+        self.format_mismatch = module.params.get("format_mismatch", "regenerate")
+        self.regenerate = module.params.get("regenerate", "full_idempotence")
         self.backend = backend
 
         self.private_key = None
@@ -103,9 +104,16 @@ class PrivateKeyBackend:
             return dict()
         result = dict(can_parse_key=False)
         try:
-            result.update(get_privatekey_info(
-                self.module, self.backend, data, passphrase=self.passphrase,
-                return_private_key_data=False, prefer_one_fingerprint=True))
+            result.update(
+                get_privatekey_info(
+                    self.module,
+                    self.backend,
+                    data,
+                    passphrase=self.passphrase,
+                    return_private_key_data=False,
+                    prefer_one_fingerprint=True,
+                )
+            )
         except PrivateKeyConsistencyError as exc:
             result.update(exc.result)
         except PrivateKeyParseError as exc:
@@ -137,7 +145,9 @@ class PrivateKeyBackend:
     def set_existing(self, privatekey_bytes):
         """Set existing private key bytes. None indicates that the key does not exist."""
         self.existing_private_key_bytes = privatekey_bytes
-        self.diff_after = self.diff_before = self._get_info(self.existing_private_key_bytes)
+        self.diff_after = self.diff_before = self._get_info(
+            self.existing_private_key_bytes
+        )
 
     def has_existing(self):
         """Query whether an existing private key is/has been there."""
@@ -165,41 +175,51 @@ class PrivateKeyBackend:
 
     def needs_regeneration(self):
         """Check whether a regeneration is necessary."""
-        if self.regenerate == 'always':
+        if self.regenerate == "always":
             return True
         if not self.has_existing():
             # key does not exist
             return True
         if not self._check_passphrase():
-            if self.regenerate == 'full_idempotence':
+            if self.regenerate == "full_idempotence":
                 return True
-            self.module.fail_json(msg='Unable to read the key. The key is protected with a another passphrase / no passphrase or broken.'
-                                  ' Will not proceed. To force regeneration, call the module with `generate`'
-                                  ' set to `full_idempotence` or `always`, or with `force=true`.')
+            self.module.fail_json(
+                msg="Unable to read the key. The key is protected with a another passphrase / no passphrase or broken."
+                " Will not proceed. To force regeneration, call the module with `generate`"
+                " set to `full_idempotence` or `always`, or with `force=true`."
+            )
         self._ensure_existing_private_key_loaded()
-        if self.regenerate != 'never':
+        if self.regenerate != "never":
             if not self._check_size_and_type():
-                if self.regenerate in ('partial_idempotence', 'full_idempotence'):
+                if self.regenerate in ("partial_idempotence", "full_idempotence"):
                     return True
-                self.module.fail_json(msg='Key has wrong type and/or size.'
-                                      ' Will not proceed. To force regeneration, call the module with `generate`'
-                                      ' set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=true`.')
+                self.module.fail_json(
+                    msg="Key has wrong type and/or size."
+                    " Will not proceed. To force regeneration, call the module with `generate`"
+                    " set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=true`."
+                )
         # During generation step, regenerate if format does not match and format_mismatch == 'regenerate'
-        if self.format_mismatch == 'regenerate' and self.regenerate != 'never':
+        if self.format_mismatch == "regenerate" and self.regenerate != "never":
             if not self._check_format():
-                if self.regenerate in ('partial_idempotence', 'full_idempotence'):
+                if self.regenerate in ("partial_idempotence", "full_idempotence"):
                     return True
-                self.module.fail_json(msg='Key has wrong format.'
-                                      ' Will not proceed. To force regeneration, call the module with `generate`'
-                                      ' set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=true`.'
-                                      ' To convert the key, set `format_mismatch` to `convert`.')
+                self.module.fail_json(
+                    msg="Key has wrong format."
+                    " Will not proceed. To force regeneration, call the module with `generate`"
+                    " set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=true`."
+                    " To convert the key, set `format_mismatch` to `convert`."
+                )
         return False
 
     def needs_conversion(self):
         """Check whether a conversion is necessary. Must only be called if needs_regeneration() returned False."""
         # During conversion step, convert if format does not match and format_mismatch == 'convert'
         self._ensure_existing_private_key_loaded()
-        return self.has_existing() and self.format_mismatch == 'convert' and not self._check_format()
+        return (
+            self.has_existing()
+            and self.format_mismatch == "convert"
+            and not self._check_format()
+        )
 
     def _get_fingerprint(self):
         if self.private_key:
@@ -210,7 +230,9 @@ class PrivateKeyBackend:
             # Ignore errors
             pass
         if self.existing_private_key:
-            return get_fingerprint_of_privatekey(self.existing_private_key, backend=self.backend)
+            return get_fingerprint_of_privatekey(
+                self.existing_private_key, backend=self.backend
+            )
 
     def dump(self, include_key):
         """Serialize the object into a dictionary."""
@@ -222,12 +244,12 @@ class PrivateKeyBackend:
                 # Ignore errors
                 pass
         result = {
-            'type': self.type,
-            'size': self.size,
-            'fingerprint': self._get_fingerprint(),
+            "type": self.type,
+            "size": self.size,
+            "fingerprint": self._get_fingerprint(),
         }
-        if self.type == 'ECC':
-            result['curve'] = self.curve
+        if self.type == "ECC":
+            result["curve"] = self.curve
         # Get hold of private key bytes
         pk_bytes = self.existing_private_key_bytes
         if self.private_key is not None:
@@ -236,14 +258,14 @@ class PrivateKeyBackend:
         if include_key:
             # Store result
             if pk_bytes:
-                if identify_private_key_format(pk_bytes) == 'raw':
-                    result['privatekey'] = base64.b64encode(pk_bytes)
+                if identify_private_key_format(pk_bytes) == "raw":
+                    result["privatekey"] = base64.b64encode(pk_bytes)
                 else:
-                    result['privatekey'] = pk_bytes.decode('utf-8')
+                    result["privatekey"] = pk_bytes.decode("utf-8")
             else:
-                result['privatekey'] = None
+                result["privatekey"] = None
 
-        result['diff'] = dict(
+        result["diff"] = dict(
             before=self.diff_before,
             after=self.diff_after,
         )
@@ -256,7 +278,9 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
     def _get_ec_class(self, ectype):
         ecclass = cryptography.hazmat.primitives.asymmetric.ec.__dict__.get(ectype)
         if ecclass is None:
-            self.module.fail_json(msg='Your cryptography version does not support {0}'.format(ectype))
+            self.module.fail_json(
+                msg="Your cryptography version does not support {0}".format(ectype)
+            )
         return ecclass
 
     def _add_curve(self, name, ectype, deprecated=False):
@@ -266,90 +290,123 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
 
         def verify(privatekey):
             ecclass = self._get_ec_class(ectype)
-            return isinstance(privatekey.private_numbers().public_numbers.curve, ecclass)
+            return isinstance(
+                privatekey.private_numbers().public_numbers.curve, ecclass
+            )
 
         self.curves[name] = {
-            'create': create,
-            'verify': verify,
-            'deprecated': deprecated,
+            "create": create,
+            "verify": verify,
+            "deprecated": deprecated,
         }
 
     def __init__(self, module):
-        super(PrivateKeyCryptographyBackend, self).__init__(module=module, backend='cryptography')
+        super(PrivateKeyCryptographyBackend, self).__init__(
+            module=module, backend="cryptography"
+        )
 
         self.curves = dict()
-        self._add_curve('secp224r1', 'SECP224R1')
-        self._add_curve('secp256k1', 'SECP256K1')
-        self._add_curve('secp256r1', 'SECP256R1')
-        self._add_curve('secp384r1', 'SECP384R1')
-        self._add_curve('secp521r1', 'SECP521R1')
-        self._add_curve('secp192r1', 'SECP192R1', deprecated=True)
-        self._add_curve('sect163k1', 'SECT163K1', deprecated=True)
-        self._add_curve('sect163r2', 'SECT163R2', deprecated=True)
-        self._add_curve('sect233k1', 'SECT233K1', deprecated=True)
-        self._add_curve('sect233r1', 'SECT233R1', deprecated=True)
-        self._add_curve('sect283k1', 'SECT283K1', deprecated=True)
-        self._add_curve('sect283r1', 'SECT283R1', deprecated=True)
-        self._add_curve('sect409k1', 'SECT409K1', deprecated=True)
-        self._add_curve('sect409r1', 'SECT409R1', deprecated=True)
-        self._add_curve('sect571k1', 'SECT571K1', deprecated=True)
-        self._add_curve('sect571r1', 'SECT571R1', deprecated=True)
-        self._add_curve('brainpoolP256r1', 'BrainpoolP256R1', deprecated=True)
-        self._add_curve('brainpoolP384r1', 'BrainpoolP384R1', deprecated=True)
-        self._add_curve('brainpoolP512r1', 'BrainpoolP512R1', deprecated=True)
+        self._add_curve("secp224r1", "SECP224R1")
+        self._add_curve("secp256k1", "SECP256K1")
+        self._add_curve("secp256r1", "SECP256R1")
+        self._add_curve("secp384r1", "SECP384R1")
+        self._add_curve("secp521r1", "SECP521R1")
+        self._add_curve("secp192r1", "SECP192R1", deprecated=True)
+        self._add_curve("sect163k1", "SECT163K1", deprecated=True)
+        self._add_curve("sect163r2", "SECT163R2", deprecated=True)
+        self._add_curve("sect233k1", "SECT233K1", deprecated=True)
+        self._add_curve("sect233r1", "SECT233R1", deprecated=True)
+        self._add_curve("sect283k1", "SECT283K1", deprecated=True)
+        self._add_curve("sect283r1", "SECT283R1", deprecated=True)
+        self._add_curve("sect409k1", "SECT409K1", deprecated=True)
+        self._add_curve("sect409r1", "SECT409R1", deprecated=True)
+        self._add_curve("sect571k1", "SECT571K1", deprecated=True)
+        self._add_curve("sect571r1", "SECT571R1", deprecated=True)
+        self._add_curve("brainpoolP256r1", "BrainpoolP256R1", deprecated=True)
+        self._add_curve("brainpoolP384r1", "BrainpoolP384R1", deprecated=True)
+        self._add_curve("brainpoolP512r1", "BrainpoolP512R1", deprecated=True)
 
         self.cryptography_backend = cryptography.hazmat.backends.default_backend()
 
-        if not CRYPTOGRAPHY_HAS_X25519 and self.type == 'X25519':
-            self.module.fail_json(msg='Your cryptography version does not support X25519')
-        if not CRYPTOGRAPHY_HAS_X25519_FULL and self.type == 'X25519':
-            self.module.fail_json(msg='Your cryptography version does not support X25519 serialization')
-        if not CRYPTOGRAPHY_HAS_X448 and self.type == 'X448':
-            self.module.fail_json(msg='Your cryptography version does not support X448')
-        if not CRYPTOGRAPHY_HAS_ED25519 and self.type == 'Ed25519':
-            self.module.fail_json(msg='Your cryptography version does not support Ed25519')
-        if not CRYPTOGRAPHY_HAS_ED448 and self.type == 'Ed448':
-            self.module.fail_json(msg='Your cryptography version does not support Ed448')
+        if not CRYPTOGRAPHY_HAS_X25519 and self.type == "X25519":
+            self.module.fail_json(
+                msg="Your cryptography version does not support X25519"
+            )
+        if not CRYPTOGRAPHY_HAS_X25519_FULL and self.type == "X25519":
+            self.module.fail_json(
+                msg="Your cryptography version does not support X25519 serialization"
+            )
+        if not CRYPTOGRAPHY_HAS_X448 and self.type == "X448":
+            self.module.fail_json(msg="Your cryptography version does not support X448")
+        if not CRYPTOGRAPHY_HAS_ED25519 and self.type == "Ed25519":
+            self.module.fail_json(
+                msg="Your cryptography version does not support Ed25519"
+            )
+        if not CRYPTOGRAPHY_HAS_ED448 and self.type == "Ed448":
+            self.module.fail_json(
+                msg="Your cryptography version does not support Ed448"
+            )
 
     def _get_wanted_format(self):
-        if self.format not in ('auto', 'auto_ignore'):
+        if self.format not in ("auto", "auto_ignore"):
             return self.format
-        if self.type in ('X25519', 'X448', 'Ed25519', 'Ed448'):
-            return 'pkcs8'
+        if self.type in ("X25519", "X448", "Ed25519", "Ed448"):
+            return "pkcs8"
         else:
-            return 'pkcs1'
+            return "pkcs1"
 
     def generate_private_key(self):
         """(Re-)Generate private key."""
         try:
-            if self.type == 'RSA':
-                self.private_key = cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(
-                    public_exponent=65537,  # OpenSSL always uses this
-                    key_size=self.size,
-                    backend=self.cryptography_backend
+            if self.type == "RSA":
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(
+                        public_exponent=65537,  # OpenSSL always uses this
+                        key_size=self.size,
+                        backend=self.cryptography_backend,
+                    )
                 )
-            if self.type == 'DSA':
-                self.private_key = cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(
-                    key_size=self.size,
-                    backend=self.cryptography_backend
+            if self.type == "DSA":
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(
+                        key_size=self.size, backend=self.cryptography_backend
+                    )
                 )
-            if CRYPTOGRAPHY_HAS_X25519_FULL and self.type == 'X25519':
-                self.private_key = cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.generate()
-            if CRYPTOGRAPHY_HAS_X448 and self.type == 'X448':
-                self.private_key = cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.generate()
-            if CRYPTOGRAPHY_HAS_ED25519 and self.type == 'Ed25519':
-                self.private_key = cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.generate()
-            if CRYPTOGRAPHY_HAS_ED448 and self.type == 'Ed448':
-                self.private_key = cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.generate()
-            if self.type == 'ECC' and self.curve in self.curves:
-                if self.curves[self.curve]['deprecated']:
-                    self.module.warn('Elliptic curves of type {0} should not be used for new keys!'.format(self.curve))
-                self.private_key = cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
-                    curve=self.curves[self.curve]['create'](self.size),
-                    backend=self.cryptography_backend
+            if CRYPTOGRAPHY_HAS_X25519_FULL and self.type == "X25519":
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.generate()
+                )
+            if CRYPTOGRAPHY_HAS_X448 and self.type == "X448":
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.generate()
+                )
+            if CRYPTOGRAPHY_HAS_ED25519 and self.type == "Ed25519":
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.generate()
+                )
+            if CRYPTOGRAPHY_HAS_ED448 and self.type == "Ed448":
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.generate()
+                )
+            if self.type == "ECC" and self.curve in self.curves:
+                if self.curves[self.curve]["deprecated"]:
+                    self.module.warn(
+                        "Elliptic curves of type {0} should not be used for new keys!".format(
+                            self.curve
+                        )
+                    )
+                self.private_key = (
+                    cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
+                        curve=self.curves[self.curve]["create"](self.size),
+                        backend=self.cryptography_backend,
+                    )
                 )
         except cryptography.exceptions.UnsupportedAlgorithm:
-            self.module.fail_json(msg='Cryptography backend does not support the algorithm required for {0}'.format(self.type))
+            self.module.fail_json(
+                msg="Cryptography backend does not support the algorithm required for {0}".format(
+                    self.type
+                )
+            )
 
     def get_private_key_data(self):
         """Return bytes for self.private_key"""
@@ -357,40 +414,62 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
         try:
             export_format = self._get_wanted_format()
             export_encoding = cryptography.hazmat.primitives.serialization.Encoding.PEM
-            if export_format == 'pkcs1':
+            if export_format == "pkcs1":
                 # "TraditionalOpenSSL" format is PKCS1
-                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.TraditionalOpenSSL
-            elif export_format == 'pkcs8':
-                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8
-            elif export_format == 'raw':
-                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.Raw
-                export_encoding = cryptography.hazmat.primitives.serialization.Encoding.Raw
+                export_format = (
+                    cryptography.hazmat.primitives.serialization.PrivateFormat.TraditionalOpenSSL
+                )
+            elif export_format == "pkcs8":
+                export_format = (
+                    cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8
+                )
+            elif export_format == "raw":
+                export_format = (
+                    cryptography.hazmat.primitives.serialization.PrivateFormat.Raw
+                )
+                export_encoding = (
+                    cryptography.hazmat.primitives.serialization.Encoding.Raw
+                )
         except AttributeError:
-            self.module.fail_json(msg='Cryptography backend does not support the selected output format "{0}"'.format(self.format))
+            self.module.fail_json(
+                msg='Cryptography backend does not support the selected output format "{0}"'.format(
+                    self.format
+                )
+            )
 
         # Select key encryption
-        encryption_algorithm = cryptography.hazmat.primitives.serialization.NoEncryption()
+        encryption_algorithm = (
+            cryptography.hazmat.primitives.serialization.NoEncryption()
+        )
         if self.cipher and self.passphrase:
-            if self.cipher == 'auto':
-                encryption_algorithm = cryptography.hazmat.primitives.serialization.BestAvailableEncryption(to_bytes(self.passphrase))
+            if self.cipher == "auto":
+                encryption_algorithm = cryptography.hazmat.primitives.serialization.BestAvailableEncryption(
+                    to_bytes(self.passphrase)
+                )
             else:
-                self.module.fail_json(msg='Cryptography backend can only use "auto" for cipher option.')
+                self.module.fail_json(
+                    msg='Cryptography backend can only use "auto" for cipher option.'
+                )
 
         # Serialize key
         try:
             return self.private_key.private_bytes(
                 encoding=export_encoding,
                 format=export_format,
-                encryption_algorithm=encryption_algorithm
+                encryption_algorithm=encryption_algorithm,
             )
         except ValueError:
             self.module.fail_json(
-                msg='Cryptography backend cannot serialize the private key in the required format "{0}"'.format(self.format)
+                msg='Cryptography backend cannot serialize the private key in the required format "{0}"'.format(
+                    self.format
+                )
             )
         except Exception:
             self.module.fail_json(
-                msg='Error while serializing the private key in the required format "{0}"'.format(self.format),
-                exception=traceback.format_exc()
+                msg='Error while serializing the private key in the required format "{0}"'.format(
+                    self.format
+                ),
+                exception=traceback.format_exc(),
             )
 
     def _load_privatekey(self):
@@ -398,27 +477,45 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
         try:
             # Interpret bytes depending on format.
             format = identify_private_key_format(data)
-            if format == 'raw':
+            if format == "raw":
                 if len(data) == 56 and CRYPTOGRAPHY_HAS_X448:
-                    return cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.from_private_bytes(data)
+                    return cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.from_private_bytes(
+                        data
+                    )
                 if len(data) == 57 and CRYPTOGRAPHY_HAS_ED448:
-                    return cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.from_private_bytes(data)
+                    return cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.from_private_bytes(
+                        data
+                    )
                 if len(data) == 32:
-                    if CRYPTOGRAPHY_HAS_X25519 and (self.type == 'X25519' or not CRYPTOGRAPHY_HAS_ED25519):
-                        return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(data)
-                    if CRYPTOGRAPHY_HAS_ED25519 and (self.type == 'Ed25519' or not CRYPTOGRAPHY_HAS_X25519):
-                        return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(data)
+                    if CRYPTOGRAPHY_HAS_X25519 and (
+                        self.type == "X25519" or not CRYPTOGRAPHY_HAS_ED25519
+                    ):
+                        return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(
+                            data
+                        )
+                    if CRYPTOGRAPHY_HAS_ED25519 and (
+                        self.type == "Ed25519" or not CRYPTOGRAPHY_HAS_X25519
+                    ):
+                        return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(
+                            data
+                        )
                     if CRYPTOGRAPHY_HAS_X25519 and CRYPTOGRAPHY_HAS_ED25519:
                         try:
-                            return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(data)
+                            return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(
+                                data
+                            )
                         except Exception:
-                            return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(data)
-                raise PrivateKeyError('Cannot load raw key')
+                            return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(
+                                data
+                            )
+                raise PrivateKeyError("Cannot load raw key")
             else:
-                return cryptography.hazmat.primitives.serialization.load_pem_private_key(
-                    data,
-                    None if self.passphrase is None else to_bytes(self.passphrase),
-                    backend=self.cryptography_backend
+                return (
+                    cryptography.hazmat.primitives.serialization.load_pem_private_key(
+                        data,
+                        None if self.passphrase is None else to_bytes(self.passphrase),
+                        backend=self.cryptography_backend,
+                    )
                 )
         except Exception as e:
             raise PrivateKeyError(e)
@@ -430,7 +527,7 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
     def _check_passphrase(self):
         try:
             format = identify_private_key_format(self.existing_private_key_bytes)
-            if format == 'raw':
+            if format == "raw":
                 # Raw keys cannot be encrypted. To avoid incompatibilities, we try to
                 # actually load the key (and return False when this fails).
                 self._load_privatekey()
@@ -438,38 +535,65 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
                 # provided.
                 return self.passphrase is None
             else:
-                return cryptography.hazmat.primitives.serialization.load_pem_private_key(
-                    self.existing_private_key_bytes,
-                    None if self.passphrase is None else to_bytes(self.passphrase),
-                    backend=self.cryptography_backend
+                return (
+                    cryptography.hazmat.primitives.serialization.load_pem_private_key(
+                        self.existing_private_key_bytes,
+                        None if self.passphrase is None else to_bytes(self.passphrase),
+                        backend=self.cryptography_backend,
+                    )
                 )
         except Exception:
             return False
 
     def _check_size_and_type(self):
-        if isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey):
-            return self.type == 'RSA' and self.size == self.existing_private_key.key_size
-        if isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey):
-            return self.type == 'DSA' and self.size == self.existing_private_key.key_size
-        if CRYPTOGRAPHY_HAS_X25519 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey):
-            return self.type == 'X25519'
-        if CRYPTOGRAPHY_HAS_X448 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey):
-            return self.type == 'X448'
-        if CRYPTOGRAPHY_HAS_ED25519 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey):
-            return self.type == 'Ed25519'
-        if CRYPTOGRAPHY_HAS_ED448 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey):
-            return self.type == 'Ed448'
-        if isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
-            if self.type != 'ECC':
+        if isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey,
+        ):
+            return (
+                self.type == "RSA" and self.size == self.existing_private_key.key_size
+            )
+        if isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey,
+        ):
+            return (
+                self.type == "DSA" and self.size == self.existing_private_key.key_size
+            )
+        if CRYPTOGRAPHY_HAS_X25519 and isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey,
+        ):
+            return self.type == "X25519"
+        if CRYPTOGRAPHY_HAS_X448 and isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey,
+        ):
+            return self.type == "X448"
+        if CRYPTOGRAPHY_HAS_ED25519 and isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey,
+        ):
+            return self.type == "Ed25519"
+        if CRYPTOGRAPHY_HAS_ED448 and isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey,
+        ):
+            return self.type == "Ed448"
+        if isinstance(
+            self.existing_private_key,
+            cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey,
+        ):
+            if self.type != "ECC":
                 return False
             if self.curve not in self.curves:
                 return False
-            return self.curves[self.curve]['verify'](self.existing_private_key)
+            return self.curves[self.curve]["verify"](self.existing_private_key)
 
         return False
 
     def _check_format(self):
-        if self.format == 'auto_ignore':
+        if self.format == "auto_ignore":
             return True
         try:
             format = identify_private_key_format(self.existing_private_key_bytes)
@@ -479,52 +603,96 @@ class PrivateKeyCryptographyBackend(PrivateKeyBackend):
 
 
 def select_backend(module, backend):
-    if backend == 'auto':
+    if backend == "auto":
         # Detection what is possible
-        can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
+        can_use_cryptography = (
+            CRYPTOGRAPHY_FOUND
+            and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
+        )
 
         # Decision
         if can_use_cryptography:
-            backend = 'cryptography'
+            backend = "cryptography"
 
         # Success?
-        if backend == 'auto':
-            module.fail_json(msg=("Cannot detect the required Python library "
-                                  "cryptography (>= {0})").format(MINIMAL_CRYPTOGRAPHY_VERSION))
-    if backend == 'cryptography':
+        if backend == "auto":
+            module.fail_json(
+                msg=(
+                    "Cannot detect the required Python library " "cryptography (>= {0})"
+                ).format(MINIMAL_CRYPTOGRAPHY_VERSION)
+            )
+    if backend == "cryptography":
         if not CRYPTOGRAPHY_FOUND:
-            module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
-                             exception=CRYPTOGRAPHY_IMP_ERR)
+            module.fail_json(
+                msg=missing_required_lib(
+                    "cryptography >= {0}".format(MINIMAL_CRYPTOGRAPHY_VERSION)
+                ),
+                exception=CRYPTOGRAPHY_IMP_ERR,
+            )
         return backend, PrivateKeyCryptographyBackend(module)
     else:
-        raise Exception('Unsupported value for backend: {0}'.format(backend))
+        raise Exception("Unsupported value for backend: {0}".format(backend))
 
 
 def get_privatekey_argument_spec():
     return ArgumentSpec(
         argument_spec=dict(
-            size=dict(type='int', default=4096),
-            type=dict(type='str', default='RSA', choices=[
-                'DSA', 'ECC', 'Ed25519', 'Ed448', 'RSA', 'X25519', 'X448'
-            ]),
-            curve=dict(type='str', choices=[
-                'secp224r1', 'secp256k1', 'secp256r1', 'secp384r1', 'secp521r1',
-                'secp192r1', 'brainpoolP256r1', 'brainpoolP384r1', 'brainpoolP512r1',
-                'sect163k1', 'sect163r2', 'sect233k1', 'sect233r1', 'sect283k1',
-                'sect283r1', 'sect409k1', 'sect409r1', 'sect571k1', 'sect571r1',
-            ]),
-            passphrase=dict(type='str', no_log=True),
-            cipher=dict(type='str', default='auto'),
-            format=dict(type='str', default='auto_ignore', choices=['pkcs1', 'pkcs8', 'raw', 'auto', 'auto_ignore']),
-            format_mismatch=dict(type='str', default='regenerate', choices=['regenerate', 'convert']),
-            select_crypto_backend=dict(type='str', choices=['auto', 'cryptography'], default='auto'),
+            size=dict(type="int", default=4096),
+            type=dict(
+                type="str",
+                default="RSA",
+                choices=["DSA", "ECC", "Ed25519", "Ed448", "RSA", "X25519", "X448"],
+            ),
+            curve=dict(
+                type="str",
+                choices=[
+                    "secp224r1",
+                    "secp256k1",
+                    "secp256r1",
+                    "secp384r1",
+                    "secp521r1",
+                    "secp192r1",
+                    "brainpoolP256r1",
+                    "brainpoolP384r1",
+                    "brainpoolP512r1",
+                    "sect163k1",
+                    "sect163r2",
+                    "sect233k1",
+                    "sect233r1",
+                    "sect283k1",
+                    "sect283r1",
+                    "sect409k1",
+                    "sect409r1",
+                    "sect571k1",
+                    "sect571r1",
+                ],
+            ),
+            passphrase=dict(type="str", no_log=True),
+            cipher=dict(type="str", default="auto"),
+            format=dict(
+                type="str",
+                default="auto_ignore",
+                choices=["pkcs1", "pkcs8", "raw", "auto", "auto_ignore"],
+            ),
+            format_mismatch=dict(
+                type="str", default="regenerate", choices=["regenerate", "convert"]
+            ),
+            select_crypto_backend=dict(
+                type="str", choices=["auto", "cryptography"], default="auto"
+            ),
             regenerate=dict(
-                type='str',
-                default='full_idempotence',
-                choices=['never', 'fail', 'partial_idempotence', 'full_idempotence', 'always']
+                type="str",
+                default="full_idempotence",
+                choices=[
+                    "never",
+                    "fail",
+                    "partial_idempotence",
+                    "full_idempotence",
+                    "always",
+                ],
             ),
         ),
         required_if=[
-            ['type', 'ECC', ['curve']],
+            ["type", "ECC", ["curve"]],
         ],
     )