Consider deriving PKCS #11 public key from certificate

[clundin25]

Currently PKCS#11 requires a public key to be token. Alternatively, the public key can be derived from the certificate, similar to the windows and macos implementations.

This would:

1. Reduce work. There is no reason to have the public key stored in the HSM, our use case only cares about the certificate.
2. Reduce mistakes. Most users of ECP will likely think a certificate and private key is enough. Extracting and loading the Public key is an awkward and extra step.

[salrashid123]

it'd help to document the specific objects you need on the device to use this proxy.

eg, you need to have the private key ofcourse but also the cert and the public key.

the cert can certainly exist outside of the device and the public key itself can get derived from private anyway.

$ pkcs11-tool --module /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so  --list-objects --pin mynewpin
Using slot 0 with a present token (0x51aac4a2)
Public Key Object; RSA 2048 bits
  label:      keylabel3
  ID:         10
  Usage:      encrypt, verify, wrap
  Access:     none
Private Key Object; RSA 
  label:      keylabel3
  ID:         10
  Usage:      decrypt, sign, unwrap
  Access:     sensitive
Certificate Object; type = X.509 cert
  label:      keylabel3
  subject:    DN: L=US, O=Google, OU=Enterprise, CN=user10.esodemoapp2.com
  serial:     1C
  ID:         10