I'm pretty sure that Francis got BIND9 working with native PKCS #11 (not the OpenSSL kludge). Don't think ISC ever did anything with the results, probably languishing in a git branch somewhere.