Importing Android/Java signing keys into NitroKey HSM2

The SmartCard-HSM does not support key import in clear, which is what pkcs15-init is trying to do. You need to use a DKEK instead, which is the method supported in the Smart Card Shell.

Importing keys in clear is a major security issue, as the key material traverses a lot of unprotected interfaces (PC/SC API, CCID API, USB-HW, Reader, CL or CC interface).

We of course understand that quickly importing a key in clear would be handy, but for professional key management that is not acceptable. Advanced key management, in particular using key domains with DKEK or XKEK, is what make the SmartCard-HSM different from other PKI cards.