code: func rsaArgs(label string, modulusLen, exponent uint, keyID []byte) generateArgs {
  	// Encode as unpadded big endian encoded byte slice
  	expSlice := big.NewInt(int64(exponent)).Bytes()
  	log.Printf("\tEncoded public exponent (%d) as: %0X\n", exponent, expSlice)
  	return generateArgs{
  		mechanism: []*pkcs11.Mechanism{
  			pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_KEY_PAIR_GEN, nil),
  		},
  		publicAttrs: []*pkcs11.Attribute{
  			pkcs11.NewAttribute(pkcs11.CKA_ID, keyID),
  			pkcs11.NewAttribute(pkcs11.CKA_LABEL, label),
  			pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
  			// Allow the key to verify signatures
  			pkcs11.NewAttribute(pkcs11.CKA_VERIFY, true),
  			// Set requested modulus length
  			pkcs11.NewAttribute(pkcs11.CKA_MODULUS_BITS, modulusLen),
  			// Set requested public exponent
  			pkcs11.NewAttribute(pkcs11.CKA_PUBLIC_EXPONENT, expSlice),
  		},
  		privateAttrs: []*pkcs11.Attribute{
  			pkcs11.NewAttribute(pkcs11.CKA_ID, keyID),
  			pkcs11.NewAttribute(pkcs11.CKA_LABEL, label),
  			pkcs11.NewAttribute(pkcs11.CKA_TOKEN, true),
  			// Prevent attributes being retrieved
  			pkcs11.NewAttribute(pkcs11.CKA_SENSITIVE, true),
  			// Prevent the key being extracted from the device
  			pkcs11.NewAttribute(pkcs11.CKA_EXTRACTABLE, false),
  			// Allow the key to create signatures
  			pkcs11.NewAttribute(pkcs11.CKA_SIGN, true),
  		},
  	}
  }
docs: // rsaArgs constructs the private and public key template attributes sent to the
  // device and specifies which mechanism should be used. modulusLen specifies the
  // length of the modulus to be generated on the device in bits and exponent
  // specifies the public exponent that should be used.