PKI is currently using python-nss (Python binding for NSS) in KRA Python client for key archival:

• https://github.com/dogtagpki/pki/blob/master/base/common/python/pki/crypto.py#L31
• https://github.com/dogtagpki/pki/blob/master/base/common/python/pki/key.py#L37
• https://github.com/dogtagpki/pki/blob/master/base/kra/functional/drmclient_deprecated.py#L40
• https://github.com/dogtagpki/pki/blob/master/base/kra/functional/drmtest.py#L50

The PKI team has been extensively maintaining JSS (Java binding for NSS) and has limited resources to maintain python-nss, so to reduce the maintenance burden the code that depends on python-nss should be replaced to use JSS instead. This can be accomplished by wrapping Java-based CLIs which use JSS in Python API.

Here are the CLIs for key archival:

• https://github.com/dogtagpki/pki/blob/master/base/java-tools/src/com/netscape/cmstools/kra/KRAKeyArchiveCLI.java
• https://github.com/dogtagpki/pki/blob/master/base/java-tools/src/com/netscape/cmstools/kra/KRAKeyRetrieveCLI.java

The CLIs take and produce JSON objects which can be generated and parsed by Python, so it should be relatively easy to wrap these CLIs in Python API. This way existing Python code that uses KRA Python client can continue to work with probably a little or no modifications.