Changed to support reading records from a certsquirt DynamoDB table, and to use KMS keys via PKCS11. If you're interested in using this, raise an issue and we will add some documentation / guidance :-)