My error logs indicate that occasionally, ncp11 is asked to match certs against a template whose types consist of [CKA_TOKEN, CKA_CLASS]. (I think Firefox is responsible for this query.) ncp11 doesn't currently have this template on its whitelist of known templates, so it generates a warning (Unknown FindObjectsInit template types: [1 0]) in the error log. AFAICT the warning is harmless (ncp11 returns an empty list of objects, which is the correct behavior), but we should still fix it since it adds noise to the error logs.