You should be able to create the key on the HSM and then import it into OpenDNSSEC, given that a proper KeyLabel exists. If the key does not have a label, you might be able to set one using pkcs11-tool (from the OpenSC package). jakob