✅ Yes — v11 introduces a rewritten PKCS#11 integration that supports selecting keys by label, and allows you to specify the certificate separately via windowsCertificatePath.

Do I still need to provide the .pem certificate in v11? ✅ Yes, unless you store the certificate with the key in a HSM that exposes both (which Cloud KMS doesn’t).

Can this be solved in Install4J v8 or v10? ❌ Unlikely, because these versions require both key + certificate to be visible in the PKCS#11 module, which libkmsp11 cannot provide.