Hi Yan, On 2026-10-12T10:47:59, Yan WANG <[email protected]> wrote:
> The implementation builds on the existing pkcs11_tool btool: a sign() > method is added that drives pkcs11-tool to perform the actual > cryptographic operation. Binman can already describe a PKCS#11 key for FIT signing: fit,engine set to pkcs11, with fit,engine-keydir and key-name-hint, which become a pkcs11: URI. This series adds a second scheme of eight properties that works quite differently. It would be better for users if pre-load followed the FIT conventions, e.g. a single PKCS#11 URI property for the token and key plus the module path. Then both entry types would be configured the same way. What do you think? Regards, Simon
