[@WTB16 Section 8] and [@WR12 Eq. (2)] (see also [@MW12 Eq. (134)]). For the benefit of the reader, we explain how to arrive at this weak-converse bound in more detail in Appendix \[sec:weak-converse-bnds\]. In the above,$$h_{2}(\varepsilon)=-\varepsilon\log_{2}\varepsilon-(1-\varepsilon)\log
_{2}(1-\varepsilon)$$ denotes the binary entropy. The bound in is a weak-converse bound because it requires the extra limit as $\varepsilon
\rightarrow0$ after taking the limit as $n\rightarrow\infty$, in order to arrive at the capacity upper bound of $-\log_{2}(1-\eta)$. The significance of the bounds in and is that they apply for any finite number $n$ of channel uses and key-quality parameter$~\varepsilon$. As such, these bounds can be used to assess the performance of any practical secret-key-agreement protocol conducted over a pure-loss channel$~\mathcal{L}_{\eta}$.

The pure-loss channel is somewhat of an ideal model for a communication channel, even if it does have a strong physical underpinning in the context of free-space communication [@YS78; @S09]. In particular, a working assumption of the model is that the channel input interacts with an environment prepared in the vacuum state. However, in practical setups, we might expect the environment to be modeled as a thermal state of a fixed mean photon number $N_{B}>0$ [@S09], and in such a case, the channel 