> If you try testing without a PKCS11 module, I'm assuming all works fine? Yep... It works fine. The fact that it crashes with Yubikey/PKCS11 made me wondering how people in Ubuntu/Debian sign images (in particular, where do they keep the private keys, apparently NOT on a Yubikey...)