This change loads opencryptoki and uses the TPM for keygen tags.

base/crypto/rsa_private_key_nss.cc

Index: base/crypto/rsa_private_key_nss.cc
diff --git a/base/crypto/rsa_private_key_nss.cc b/base/crypto/rsa_private_key_nss.cc
index e952c8971b97d3e58fd4bd8e4a91f80a8c04e79c..9c474ff2241ea1024b97bda3b589162324e15b5b 100644
--- a/base/crypto/rsa_private_key_nss.cc
+++ b/base/crypto/rsa_private_key_nss.cc
@@ -107,7 +107,7 @@ RSAPrivateKey* RSAPrivateKey::FindFromPublicKeyInfo(
 
   // Now, look for the associated private key in the user's NSS DB.  If it's
   // not there, consider that an error.
-  PK11SlotInfo *slot = GetDefaultNSSKeySlot();
+  PK11SlotInfo *slot = GetPrivateNSSKeySlot();
   if (!slot) {
     NOTREACHED();
     return NULL;
@@ -190,7 +190,7 @@ RSAPrivateKey* RSAPrivateKey::CreateWithParams(uint16 num_bits,
 
   scoped_ptr<RSAPrivateKey> result(new RSAPrivateKey);
 
-  PK11SlotInfo *slot = GetDefaultNSSKeySlot();
+  PK11SlotInfo *slot = GetPrivateNSSKeySlot();
   if (!slot)
     return NULL;
 
@@ -216,7 +216,7 @@ RSAPrivateKey* RSAPrivateKey::CreateFromPrivateKeyInfoWithParams(
 
   scoped_ptr<RSAPrivateKey> result(new RSAPrivateKey);
 
-  PK11SlotInfo *slot = GetDefaultNSSKeySlot();
+  PK11SlotInfo *slot = GetPrivateNSSKeySlot();
   if (!slot)
     return NULL;