This change loads opencryptoki and uses the TPM for keygen tags.

net/base/keygen_handler_nss.cc

Index: net/base/keygen_handler_nss.cc
diff --git a/net/base/keygen_handler_nss.cc b/net/base/keygen_handler_nss.cc
index 74fb9a64e411b87b8379d4239f23ccf2b218f6c2..726aa96c49a9a1e412bfaf9bb692de8cecc11172 100644
--- a/net/base/keygen_handler_nss.cc
+++ b/net/base/keygen_handler_nss.cc
@@ -20,17 +20,17 @@ std::string KeygenHandler::GenKeyAndSignChallenge() {
   // Ensure NSS is initialized.
   base::EnsureNSSInit();
 
-  // TODO(mattm): allow choosing which slot to generate and store the key?
-  base::ScopedPK11Slot slot(base::GetDefaultNSSKeySlot());
+  // TODO(mattm): allow choosing which slot to generate and store the key.
+  base::ScopedPK11Slot slot(base::GetRsaKeySlot());
   if (!slot.get()) {
-    LOG(ERROR) << "Couldn't get internal key slot!";
+    LOG(ERROR) << "Couldn't get RSA key slot from NSS!";
     return std::string();
   }
 
   // Authenticate to the token.
   if (SECSuccess != PK11_Authenticate(slot.get(), PR_TRUE,
                                       crypto_module_password_delegate_.get())) {
-    LOG(ERROR) << "Couldn't authenticate to internal key slot!";
+    LOG(ERROR) << "Couldn't authenticate to RSA key slot!";

[wtc, 2011/03/16 18:41:44]

The "RSA key slot" strings in this file should be changed
to "preferred key slot" or "permanent key slot".

[Greg Spencer (Chromium), 2011/03/16 21:37:51]

Done.

     return std::string();
   }