Function redact_private_keys 

pub fn redact_private_keys(text: &str) -> String

Blanks PEM private keys (-----BEGIN ... PRIVATE KEY----- blocks), never a certificate. Public — continuity.rs’s own tests exercise this pass in isolation (ReAgent P0 on #3643: a certificate ahead of a key must not end the scan and let the key through).