This change loads opencryptoki and uses the TPM for keygen tags.

net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp

Index: net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
diff --git a/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp b/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
index 4b49929121a2162e2ccbebc7645bc383e1212f67..f8d4a455be9bf6c85acfffdce72f5ee9aa1be23e 100644
--- a/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
+++ b/net/third_party/mozilla_security_manager/nsNSSCertificateDB.cpp
@@ -56,7 +56,7 @@ bool ImportCACerts(const net::CertificateList& certificates,
                    net::X509Certificate* root,
                    unsigned int trustBits,
                    net::CertDatabase::ImportCertFailureList* not_imported) {
-  base::ScopedPK11Slot slot(base::GetDefaultNSSKeySlot());
+  base::ScopedPK11Slot slot(base::GetPublicNSSKeySlot());
   if (!slot.get()) {
     LOG(ERROR) << "Couldn't get internal key slot!";
     return false;
@@ -163,7 +163,7 @@ bool ImportCACerts(const net::CertificateList& certificates,
 // Based on nsNSSCertificateDB::ImportServerCertificate.
 bool ImportServerCert(const net::CertificateList& certificates,
                       net::CertDatabase::ImportCertFailureList* not_imported) {
-  base::ScopedPK11Slot slot(base::GetDefaultNSSKeySlot());
+  base::ScopedPK11Slot slot(base::GetPublicNSSKeySlot());
   if (!slot.get()) {
     LOG(ERROR) << "Couldn't get internal key slot!";
     return false;