It's by design as nobody cared yet :-) I think
it's easy to implement it. Unfortunately,
it requires a slight modification of the libdnssec API, so it won't be possible to
backport it to 3.1.
Thanks, Daniel.
A bit of scripting might suffice; pseudo-code as I'm in relax mode away from the
scene
of the crime ;)
keymgr -l | while read z; do
keymgr $z list | while read cka_id rest; do
p11tool --set-label $z ...
done
done
Best,
-JP