Use only PK11_ImportCert to import certs, not CERT_ImportCerts
    
    CERT_ImportCerts always imports a given certificate into the
    certificate database, whether a token is requested or not.
    
    Using PK11_ImportCert will import the cert, associate the key
    properly and will only add the certificate to the appropriate
    token.