Under the cgd(4) framework, I wanted to be able to generate a
corresponding raw key (for use on stdin of "cgdconfig -s") from a
given storedkey.  After not being able to figure it out for several
attempts, I looked at some "hexdump -C" outputs, and finally came
up with 

    echo <base64-encoded, storedkey value> |
      openssl base64 -d |
      sed 's/^....//'

to produce the key I wanted.

  Yes, the above tack does seem to do what I want--assuming I have
access to a paramsfile with exactly one keygen method; but what's a
clean, correct way (if any) to do this?

Thanks,  --Dave