1)      During a format operation, it is presumed that data on the token
allocated by the applet just goes away since the applet is removed and a new
one created. I do see a delete command in the TPS logs consistent with this
presumption.

[2016-02-24 13:34:19] 682e7340 AP_Session::WriteMsg- Sent 's=119&msg_type=9&pdu
_size=29&pdu_data=%84%E4%00%00%18%4C%27%69%B3%6E%31%DB%20%F6%DF%BE%1E%4F%1F%2C%
77%22%76%C0%7C%EA%8E%6B%41'

          This DELETE Command (Global Platform 2.1.1) should go down to the
token to delete the object and this should result in removal of allocated data
from the token

2)      During an enroll operation post  format, it might be safe to assume
that the data was initialized before allocating memory for the new keys

This line is executed in the constructor suggests initialized memory is used:

keys          = new Key       [MAX_NUM_KEYS];


3)      During a re-enroll when certificates are removed from a token, I would
expect that all data pertaining to private keys are removed as well. I don?t
see an explicit command sent to the card from TPS to clear the memory occupied
by the removed certificate containing private keys.  I understand that most
often when certificates are deleted, there are new ones to take their place,
which will likely overwrite the key data. But the issue I am bringing up is the
window of exposure after private keys are removed but before new ones are
added.

Add an explicit  command to zero out the key data. Here is an example of such a
command from the CoolKey Applet Interface Specification document:

CLA 0x84 or 0xB0
INS 0x52
P1 0x00
P2 Zero Flag
P3 0x04
DATA

Zero Flag
0x01 Write zeros to object memory before release
0x00 Memory zeroing not required