ok, rhevm-backend-3.6.2.6-0.1.el6.noarch

# sed -n '/ssh-keygen \\/,/^$/p'  /usr/share/ovirt-engine/bin/pki-enroll-openssh-cert.sh 
                ssh-keygen \
                        -s "${TMPCA}" \
                        -P "" \
                        -I "${id}" \
                        ${host:+-h} \
                        -V "-1h:+${days}d" \
                        ${principals:+${principal_arg} "${principals}"} \
                        $(printf "${options}" | xargs -ix -d',' echo -O x) \
                        "${sshpub}" \
                        || die "ssh-keygen failed"
        ) || die "Cannot sign ssh certificate"
}

[root@jb-rhevm36 tmp]# ssh-keygen -y -f /etc/pki/ovirt-engine/keys/engine_id_rsa 
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/duIBjjAet3mGfKa+aFv1aU9Vc4Blb6sDSjRGP5NtpLPbZNvDnFDchRF0AG6s6jYNvo2FnA9rfZpLCOr03pVHbQ6hyO6PJdJWFzPyxwi36kpkboftj5jCLUeI05Wxz346SRGw27OKEHtraPgfoXYm6Kq0tbAShT8aAvT9fp5AHAPCkLNmiViS7GIqDWoy+WQK9TiNJrvW+5mFvEug5dnqgZqsf8S1NJp5wWVWlA4IAS20qDo9H/U2/K47bSO45UE98rrELBwmLE5RraRKXbQtLiZPpYbaDx068wdbKpAYuZ29AWl3p//R3aY+tU2+3mnCpb6ojykJI25NQBtT3moX
[root@jb-rhevm36 tmp]# ls -l /etc/pki/ovirt-engine/keys/engine_id_rsa 
-rw-------. 1 root root 1828 Aug 17 13:37 /etc/pki/ovirt-engine/keys/engine_id_rsa

if there would be passphrase, 'ssh-keygen -y -f' would prompt for one.