if ( node->privKey->keyType == pubKey->keyType ) {
if (node->privKey->keyType == seckeyLow_KeyType(pubKey->keyType)) {
add_cert_to_list(CERTCertificate *cert, SECItem *k, void *pdata){    keyList *keylist;    pk11keyNode *node;    SECKEYPublicKey *pubKey = NULL;    SECItem *pubItem;    CERTCertificate *oldcert;        keylist = (keyList *)pdata;        /* only if it is a user cert and has a nickname!! */    if ( ( ( cert->trust->sslFlags & CERTDB_USER ) ||	  ( cert->trust->emailFlags & CERTDB_USER ) ||	  ( cert->trust->objectSigningFlags & CERTDB_USER ) ) &&	( cert->nickname != NULL ) ) {	/* get cert's public key */	pubKey = CERT_ExtractPublicKey(cert);	if ( pubKey == NULL ) {	    goto done;	}	/* pk11_GetPubItem returns data associated with the public key.	 * one only needs to free the public key. This comment is here	 * because this sematic would be non-obvious otherwise.	 */	pubItem = pk11_GetPubItem(pubKey);	if (pubItem == NULL) goto done;	node = keylist->head;	while ( node ) {	    /* if key type is different, then there is no match */	    if ( node->privKey->keyType == pubKey->keyType ) {		/* compare public value from cert with public value from		 * the key		 */		if ( SECITEM_CompareItem(pubItem, node->pubItem) == SECEqual ){		    /* this is a match */		    /* if no cert has yet been found for this key, or this		     * cert is newer, then save this cert		     */		    if ( ( node->cert == NULL ) || 			CERT_IsNewer(cert, node->cert ) ) {			oldcert = node->cert;						/* get a real DB copy of the cert, since the one			 * passed in here is not properly recorded in the			 * temp database			 */			/* We need a better way to deal with this */			node->cert =			    CERT_FindCertByKeyNoLocking(CERT_GetDefaultCertDB(),						        &cert->certKey);			/* free the old cert if there was one */			if ( oldcert ) {			    CERT_DestroyCertificate(oldcert);			}		    }		}	    }	    	    node = node->next;	}    }done:    if ( pubKey ) {	SECKEY_DestroyPublicKey(pubKey);    }    return(SECSuccess);}