def _read_private_key_file(self, tag, filename, password=None):
with open(filename, "<STR_LIT:r>") as f:<EOL><INDENT>data = self._read_private_key(tag, f, password)<EOL><DEDENT>return data<EOL>
Read an SSH2-format private key file, looking for a string of the type
``"BEGIN xxx PRIVATE KEY"`` for some ``xxx``, base64-decode the text we
find, and return it as a string.  If the private key is encrypted and
``password`` is not ``None``, the given password will be used to
decrypt the key (otherwise `.PasswordRequiredException` is thrown).

:param str tag: ``"RSA"`` or ``"DSA"``, the tag used to mark the
    data block.
:param str filename: name of the file to read.
:param str password:
    an optional password to use to decrypt the key file, if it's
    encrypted.
:return: data blob (`str`) that makes up the private key.

:raises: ``IOError`` -- if there was an error reading the file.
:raises: `.PasswordRequiredException` -- if the private key file is
    encrypted, and ``password`` is ``None``.
:raises: `.SSHException` -- if the key file is invalid.