Convert the RSA keys stored in the HSM into a format that Bind9 understands. The dnssec-keyfromlabel tool from Bind9 can link the raw keys stored in the HSM with the K<zone>+<alg>+<id> files. Provide the algorithm and the PKCS#11 label that specify the token, the name of the PKCS#11 object (called label when generating the keys using pkcs11-tool) and the HSM slot PIN.