Add new options:
--pkcs11-initca Build root CA on PKCS#11 token
--pkcs11-loadca Load root CA (priv/pub/crt) into PKCS#11 token