}

		var curve elliptic.Curve
		switch key.Crv {
		case "P-224":
			curve = elliptic.P224()
		case "P-256":
			curve = elliptic.P256()
		case "P-384":
			curve = elliptic.P384()
		case "P-521":
			curve = elliptic.P521()
		default:
			return nil, fmt.Errorf("Unknown curve type: %s", key.Crv)
		}

		xbuf, err := base64.RawURLEncoding.DecodeString(key.X)
		if err != nil {

// preference order.
// https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.22.0:ssh/common.go;l=44
var supportedKexAlgos = []string{
	kexAlgoCurve25519SHA256, kexAlgoCurve25519SHA256LibSSH,
	// P384 and P521 are not constant-time yet, but since we don't
	// reuse ephemeral keys, using them for ECDH should be OK.
	kexAlgoECDH256, kexAlgoECDH384, kexAlgoECDH521,
	kexAlgoDH14SHA256, kexAlgoDH16SHA512, kexAlgoDH14SHA1,

pkg context, func WithCancelCause(Context) (Context, CancelCauseFunc) #51365
pkg context, type CancelCauseFunc func(error) #51365
pkg crypto/ecdh, func P256() Curve #52221
pkg crypto/ecdh, func P384() Curve #52221
pkg crypto/ecdh, func P521() Curve #52221
pkg crypto/ecdh, func X25519() Curve #52221
pkg crypto/ecdh, method (*PrivateKey) Bytes() []uint8 #52221
pkg crypto/ecdh, method (*PrivateKey) Curve() Curve #52221

pkg crypto/elliptic, func Marshal(Curve, *big.Int, *big.Int) []uint8
pkg crypto/elliptic, func P224() Curve
pkg crypto/elliptic, func P256() Curve
pkg crypto/elliptic, func P384() Curve
pkg crypto/elliptic, func P521() Curve
pkg crypto/elliptic, func Unmarshal(Curve, []uint8) (*big.Int, *big.Int)
pkg crypto/elliptic, method (*CurveParams) Add(*big.Int, *big.Int, *big.Int, *big.Int) (*big.Int, *big.Int)