Caml Crush: an OCaml PKCS#11 filtering proxy