To generate a zone-signing key (ZSK) and a key-signing key (KSK) on the HSM use the p11tool2 utility. After the keys are generated on HSM, use dnssec-keyfromlabel provided by BIND to generate the key files for BIND containing a public key and an identifier of the actual private key.
