func (v *SSHAgent) Refresh(force bool, invocation string) error {
	socket := os.Getenv("SSH_AUTH_SOCK")
	if socket == "" {
		return errors.New("SSH_AUTH_SOCK is not set so we can't update your ssh-agent")
	}

	conn, err := net.Dial("unix", socket)
	if err != nil {
		return errors.New(
			fmt.Sprintf("Failed to open SSH_AUTH_SOCK: %v", err))
	}

	pubKeyContent, err := v.ReadFile(v.params["pub_key"])
	if err != nil {
		return err
	}

	pubKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pubKeyContent))

	agentClient := agent.NewClient(conn)
	agentClient.Remove(pubKey)

	// Because it's always possible for the cert in the ssh-agent to not be the same cert that is on disk
	// or even the same cert from the last time dk was run we just look over all keys and remove the certs.
	// I think it is reasonable to assume no one else is setting up certs for other uses.
	keys, _ := agentClient.List()
	for _, key := range keys {
		if key.Type() == "ssh-rsa-cert-v01@openssh.com" {
			cert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(key.String()))
			if err != nil {
				return err
			}

			agentClient.Remove(cert)
		}
	}

	privKeyPath, err := v.PubKeyToPrivate(v.params["pub_key"])
	if err != nil {
		return err
	}

	privKeyContent, err := v.ReadFile(privKeyPath)
	if err != nil {
		return err
	}

	privKey, err := ssh.ParseRawPrivateKey([]byte(privKeyContent))
	if err != nil {
		return err
	}

	certPath, err := v.PubKeyToCert(v.params["pub_key"])

	certContent, err := v.ReadFile(certPath)
	if err != nil {
		return err
	}

	certKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(certContent))
	if err != nil {
		return err
	}

	cert, ok := certKey.(*ssh.Certificate)
	if !ok {
		return errors.New("key was not a certificate")
	}

	// Only keep the keys in the agent as long as the cert is good for. The private key by itself
	// is no longer userful in our environment.
	now := time.Now()
	var ttl uint64
	if cert.ValidBefore > uint64(now.Unix()) {
		ttl = cert.ValidBefore - uint64(now.Unix())
	}

	keyToAdd := agent.AddedKey{
		PrivateKey:   privKey,
		Certificate:  cert,
		LifetimeSecs: uint32(ttl),
		Comment:      "managed",
	}

	err = agentClient.Add(keyToAdd)
	if err != nil {
		return err
	}

	return nil
}