cloned from https://pagure.io/freeipa/issue/9865

LWCA private keys currently generated by PKI are stored in the CA NSS database. Custodia handles syncing keys between CAs.

If PKI can generate a private key on an HSM, or some other mechanism, then we need to disable Custodia because the key will be synced using other means. This should be ok since on HSM installs custodia is already disabled.

PKI has the capability to generate a LWCA private key on the HSM by specifying the token name along with a colon as the prefix, e.g. mytoken:lwca.

We need to abstract that to not require users to remember to use the token name when generating a LWCA.