Could this be an issue of a version of pkcs11-tool? mine does not show --encrypt:
(venv_cloud_secrets) wola@WATTNUX2:~/cloud_secrets$ pkcs11-tool --module /usr/local/lib/libsc-hsm-pkcs11.so -O --login --pin 648219 --id 05d18a56eff4070e --encrypt --mech AES-CBC --input-file plain --output-file cipher
pkcs11-tool: unrecognized option '--encrypt'
Usage: pkcs11-tool [OPTIONS]
Options: [...]