Minor The sessions are currently not locked.
The PKCS#11 API says that it is not safe to share a session between multiple threads. I thus did not have a mutex lock on the session. Do we need to have it for other operations? Or can we drop the TODOs in the code?