a suggestion for improving pkinit preauth plugin token choosing
hartmans at MIT.EDU
Mon May 10 19:57:50 EDT 2010
I think slot/token ID is sufficient if you will try a specified
slot/token even if you were not able to examine its certs because login
would be required.
More information about the krbdev