I have a feature request related to this issue. Let’s say I want to avoid that the SSS share values ever be output on the screen or even go through the RAM of the PC (like it is the case for other much pricier HSMs), when I run the command create-dkek-share with a threshold scheme . One solution would consist, for each generated share value, to have the key custodian enter a password of his/her choice, and make the HSM encrypt the share value with this password using password-based encryption scheme, and either store the result in the HSM, or return it to the sc-hsm-tool to be saved outside.
To implement that, is it necessary to modify Nitrokey’s firmware? or simply modifying OpenSC would be enough (esp. sc-hsm-tool) ?