DestroyKeys destroys any existing key objects stored in the HSM token.

GenerateKCA generates an ECDSA key pair and and root self-signed CA certificate if there is no private key with matching `kcaPrivName` label.

GenerateKG generates a new KG key if there are no secret keys with a matching `kgName` label.

LoadHighSecKdfSeed loads a high security secret seed that may be used to derive symmetric keys from during the provisioning flow.

LoadLowSecKdfSeed loads a low security secret seed that may be used to derive symmetric keys from during the provisioning flow.