Caml Crush: an OCaml PKCS11 filtering proxy