systemd
PKCS#11 support
I don't know if this is out of scope for mkosi: For strictly creating development/testing images, storing keys in hardware tokens is surely overkill. However, if the Project is also meant to be suitable for creating productive images (e.g. immutable os images for your notebook or shipping-ready sysexts), having the keys stored non-exportable would be very nice from a security perspective.
For sbsign this should(?) be possible by selecting a pkcs11 openssl-engine; to create the verity signature (without requiring an extra python library) it might be necessary to shell out to openssl?
I think that's a good idea and will happily review patches.
Shelling out to openssl is fine (we currently do that to generate secure boot keys), but we've also relaxed the "only stdlib" policy somewhat and are using cryptography for the verity stuff. External packages are fine for limited stuff, where people can ignore the dependency if they are not using said feature (like cryptography for verity related things or portage for building Gentoo images).
This is going to needs lots of support in the systemd tooling we use first
