Package bind-pkcs11-utils

Bind tools with native PKCS#11 for using DNSSEC

http://www.isc.org/products/BIND/

This is a set of PKCS#11 utilities that when used together create rsa
keys in a PKCS11 keystore. Also utilities for working with DNSSEC
compiled with native PKCS#11 functionality are included.

System Administration (Section 8)
pkcs11-destroy
pkcs11-destroy destroys keys stored in a PKCS#11 device, identified by their ID or label. Matching keys are displayed before being destroyed. By default, there...
pkcs11-keygen
pkcs11-keygen causes a PKCS#11 device to generate a new key pair with the given label (which must be unique) and with keysize bits of prime.
pkcs11-list
pkcs11-list lists the PKCS#11 objects with ID or label or by default all objects. The object class, label, and ID are displayed for all keys. For private or...
pkcs11-tokens
pkcs11-tokens lists the PKCS#11 available tokens with defaults from the slot/token scan performed at application initialization.