TKTokenSession not used

Hi,

I'm working on developing my own CryptoTokenKit (CTK) extension to enable codesign with HSM-backed keys. Here's what I’ve done so far:

• The container app sets up the tokenConfiguration with TKTokenKeychainCertificate and TKTokenKeychainKey.
• The extension registers successfully and is visible via pluginkit when launching the container app.
• The virtual smartcard appears when running security list-smartcards.
• The certificate, key, and identity are all visible using security export-smartcard -i [card].

However, nothing appears in the Keychain.

After adding logging and reviewing output in the Console, I’ve observed the following behavior when running codesign:

1. My TKTokenSession is instantiated correctly, using my custom TKToken implementation — so far, so good.
2. However, none of the following TKTokenSession methods are ever called:

func tokenSession(_ session: TKTokenSession, beginAuthFor operation: TKTokenOperation, constraint: Any) throws -> TKTokenAuthOperation
func tokenSession(_ session: TKTokenSession, supports operation: TKTokenOperation, keyObjectID: TKToken.ObjectID, algorithm: TKTokenKeyAlgorithm) -> Bool
func tokenSession(_ session: TKTokenSession, sign dataToSign: Data, keyObjectID: Any, algorithm: TKTokenKeyAlgorithm) throws -> Data
func tokenSession(_ session: TKTokenSession, decrypt ciphertext: Data, keyObjectID: Any, algorithm: TKTokenKeyAlgorithm) throws -> Data
func tokenSession(_ session: TKTokenSession, performKeyExchange otherPartyPublicKeyData: Data, keyObjectID objectID: Any, algorithm: TKTokenKeyAlgorithm, parameters: TKTokenKeyExchangeParameters) throws -> Data

The only relevant Console log is:

default 11:31:15.453969+0200 PersistentToken [0x154d04850] invalidated because the client process (pid 4899) either cancelled the connection or exited

There’s no crash report related to the extension, so my assumption is that ctkd is closing the connection for some unknown reason.

Is there any way to debug this further?

Thank you for your help.