I'm trying to get a hold of a private key that doesn't seem to be exportable from Keychain Access.app directly on OS X, probably because it was imported with the option to make it non-extractable.
What I think might work is trying to intercept the said private key when it's used by the VPN software, the web-browser or some system software for the actual PKI authentication; is there a way to do this, perhaps with DTrace?
