This change loads opencryptoki and uses the TPM for keygen tags.

net/base/cert_database.h

Index: net/base/cert_database.h
diff --git a/net/base/cert_database.h b/net/base/cert_database.h
index c03bca99fe425a98a327114a83cdbb778bc7f9c5..42045781d968b7a57737d881b475a6955477b1fe 100644
--- a/net/base/cert_database.h
+++ b/net/base/cert_database.h
@@ -93,9 +93,13 @@ class CertDatabase {
   // instance of all certificates.)
   void ListCerts(CertificateList* certs);
 
-  // Get the default module.
+  // Get the default module for public key data.
   // The returned pointer must be stored in a scoped_refptr<CryptoModule>.
-  CryptoModule* GetDefaultModule() const;
+  CryptoModule* GetPublicModule() const;
+
+  // Get the default module for private key or mixed private/public key data.
+  // The returned pointer must be stored in a scoped_refptr<CryptoModule>.
+  CryptoModule* GetPrivateModule() const;

[wtc, 2011/04/07 05:56:33]

Same here -- the use of "Public" vs. "Private" is confusing.
Perhaps GetNSSDBModule and GetPreferredPrivateKeyModule.

 
   // Get all modules.
   // If |need_rw| is true, only writable modules will be returned.