While using pkcs11-tool is convenient, it would be better to just use the pkcs11 c interface directly and remove the dependency on pkcs11-tool (which brings quite a few other dependencies to the base image).