Source: imx-code-signing-tool Severity: seriouscode/back_end-hsm contains doc/HSM-CST_UG.pdf which has an unclear license and is probably not in source format. Also, the OASIS PKCS#11 headers are contained in the subdirectory src/include. It is unclear whether OASIS is DFSG-free (see #952951).
As the package is not built with the hsm backend, an easy solution is removing it entirely.
