It's been a bit, and I don't know whether I actually thanked you for the
feature, but I've just successfully tested generating a key and finding the key
label in the HSM:
$ keymgr -c knot.conf 
example.com generate ...
72325c...dba92591a
$ cklist -n --cka-label "example.com. KSK"
...
  Public objects only (don't use PIN)  CKA_CLASS CKO_PUBLIC_KEY
   CKA_TOKEN true
   CKA_PRIVATE false
   CKA_MODIFIABLE true
   CKA_LABEL "example.com. KSK"
   CKA_NFKM_APPNAME "pkcs11"
   CKA_ID length 20
     { 72325C...D BA92591A }
Thank you very much!
        -JP