With which tool invocation could I set up a transport PIN for a Nitrokey HSM? A transport PIN would force the user to change the PIN to another value before they can do anything else, thus ensuring that the HSM can not been used between setting the transport PIN and changing the PIN again.
This can be done with the Key Manager in the Smart Card Shell. Select “Transport-PIN” during device initialization and choose a transport-PIN in the next dialog.
There is currently no command line tool to do that, but we are working on an enhanced version of the sc-hsm-tool from OpenSC that supports more features of the SmartCard-HSM.
For larger deployments we generally recommend to use the scripting environment and prepare scripts that do repeated provisioning. The scripting environment is always the most-up-to-date tool to work with a SmartCard-HSM, as we use that for internal testing.
The PKI-as-a-Service Portal is also based on the scripting environment and as well a good option for larger deployments.