p11tool shouldn't require the --login parameter
On several commands like --generate-rsa
p11tool fails to operate because the --login
option was not provided. Given that the PKCS11 API warns with the USER_ERROR code, it should be able to recover and ask for PIN nevertheless.