Spec for storage of trust assertions in pkcs11 objects