Code-wise looks good. Can you squash the changes into single commit?

Code-wise looks good. Can you squash the changes into single commit?

Done

Thank you for your contribution!

I noticed that the --undestroyable option is currently only implemented for certificate objects (when using --write-object with --type cert). However, it does not seem to be supported for other object types such as privkey, pubkey, secrkey, or data.

This behavior is not documented in the help text of --undestroyable, which gives the impression that it should work universally across all writable object types.

Could you clarify:

Is this limitation intentional for security or technical reasons?
Would the project be open to extending --undestroyable support to all object types?
This feature would be valuable for use cases where long-term key material (e.g., device identity keys) must be protected from accidental or malicious deletion.

Thank you for your work on this essential tool!

Sounds like this was the author original use case to have undestroyable certificate. I think it makes sense to support this for other object types so feel free to open a PR with the changes to do so!

CKA_DESTROYABLE can be set for any storage object, it is not limited to certificates.
The limitation is because I could only test it with certificates.
Feel free to generalize it for all the storage objects.