PKCS #11 support request about acmetool HOT 1 OPEN

I can see two ways of adding PKCS #11 support that might work without building it into acmetool.

• You might allow want notation that installs a public key and (something that handles like) a private key. In case of PKCS #11, the latter could for example be a pkcs11: URI. I am assuming that the private key is not actually used by acmetool, but merely passed as a blob after it was generated.
• You might allow a hook for keypair generation, in which case rollovers of key pairs are possible even when PKCS #11 is used.

If my suspicion is correct, then PKCS #11 could be "hacked in" with the target file's request.key but it feels that would be blasphemic, and possibly unstable. Tool integration, even as lightweight as above, is preferred. Or is it merely a matter of documenting this use case? I am unsure.

from acmetool.