Managing Self-Defending KMS Keys With OpenSSL and pkcs11-tool