Re: [pkcs11] Re: Updates to CKA_GLOBAL, CKM_CERTIFY_KEY and CKM_SEAL_KEY

So the enforcement of this then becomes the responsibility of C_(Un/)WrapKey() and also requires the concept of the CKA_GLOBAL for presence?  Would it make more sense to just make a new key type for this mechanism?