Yeah, that would be very usefull to have pkcs11 interface out of box, so I could pkg_add opensc on fresh openbsd box and use smart card for authentication. This patching thing is overkill. Why not to incorporate it into openssh? pkcs11 is open standart and patch is bsd licensed, right?