diff --git a/NuGet.config b/NuGet.config
index 2b46621d9..b746b083a 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -1,25 +1,25 @@
-<?xml version="1.0" encoding="utf-8"?>
-<configuration>
-  <config>
-    <add key="restoreIgnoreFailedSources" value="true" />
-  </config>
-  <packageSources>
-    <clear />
-    <add key="local" value="local-nuget" />
-    <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
-    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
-  </packageSources>
-  <packageSourceMapping>
-    <packageSource key="local">
-      <package pattern="Mongo2Go" />
-      <package pattern="Microsoft.IdentityModel.Tokens" />
-      <package pattern="Microsoft.Extensions.Http.Polly" />
-      <package pattern="Microsoft.Extensions.Caching.Memory" />
-      <package pattern="Microsoft.Extensions.Configuration" />
-      <package pattern="Microsoft.Extensions.Configuration.Binder" />
-      <package pattern="Microsoft.Extensions.DependencyInjection.Abstractions" />
-      <package pattern="Microsoft.Extensions.Hosting" />
-      <package pattern="Microsoft.Extensions.Hosting.Abstractions" />
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <config>
+    <add key="restoreIgnoreFailedSources" value="true" />
+  </config>
+  <packageSources>
+    <clear />
+    <add key="local" value="local-nuget" />
+    <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="local">
+      <package pattern="Mongo2Go" />
+      <package pattern="Microsoft.IdentityModel.Tokens" />
+      <package pattern="Microsoft.Extensions.Http.Polly" />
+      <package pattern="Microsoft.Extensions.Caching.Memory" />
+      <package pattern="Microsoft.Extensions.Configuration" />
+      <package pattern="Microsoft.Extensions.Configuration.Binder" />
+      <package pattern="Microsoft.Extensions.DependencyInjection.Abstractions" />
+      <package pattern="Microsoft.Extensions.Hosting" />
+      <package pattern="Microsoft.Extensions.Hosting.Abstractions" />
       <package pattern="Microsoft.Extensions.Http" />
       <package pattern="Microsoft.Extensions.Logging.Abstractions" />
       <package pattern="Microsoft.Extensions.Options" />
@@ -28,9 +28,16 @@
       <package pattern="Microsoft.IdentityModel.Logging" />
       <package pattern="Microsoft.IdentityModel.Abstractions" />
       <package pattern="Microsoft.AspNetCore.Authentication.JwtBearer" />
-      <package pattern="Google.Protobuf" />
+      <package pattern="Google.Protobuf" />
+      <package pattern="Google.Api.*" />
+      <package pattern="Google.Apis.*" />
+      <package pattern="Google.Cloud.*" />
+      <package pattern="Google.LongRunning" />
       <package pattern="Grpc.*" />
-    </packageSource>
+      <package pattern="AWSSDK.*" />
+      <package pattern="Pkcs11Interop" />
+      <package pattern="System.Management" />
+    </packageSource>
     <packageSource key="dotnet-public">
       <package pattern="Microsoft.Extensions.*" />
       <package pattern="Microsoft.AspNetCore.*" />
@@ -38,8 +45,8 @@
       <package pattern="Microsoft.OpenApi*" />
       <package pattern="System.Diagnostics.*" />
     </packageSource>
-    <packageSource key="nuget.org">
-      <package pattern="*" />
-    </packageSource>
-  </packageSourceMapping>
-</configuration>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>
diff --git a/local-nuget/AWSSDK.Core.4.0.1.3.nupkg b/local-nuget/AWSSDK.Core.4.0.1.3.nupkg
new file mode 100644
index 000000000..39fd7bd0a
Binary files /dev/null and b/local-nuget/AWSSDK.Core.4.0.1.3.nupkg differ
diff --git a/local-nuget/AWSSDK.KeyManagementService.4.0.6.nupkg b/local-nuget/AWSSDK.KeyManagementService.4.0.6.nupkg
new file mode 100644
index 000000000..8a2377e7a
Binary files /dev/null and b/local-nuget/AWSSDK.KeyManagementService.4.0.6.nupkg differ
diff --git a/local-nuget/Google.Api.CommonProtos.2.17.0.nupkg b/local-nuget/Google.Api.CommonProtos.2.17.0.nupkg
new file mode 100644
index 000000000..a948c6682
Binary files /dev/null and b/local-nuget/Google.Api.CommonProtos.2.17.0.nupkg differ
diff --git a/local-nuget/Google.Api.Gax.4.11.0.nupkg b/local-nuget/Google.Api.Gax.4.11.0.nupkg
new file mode 100644
index 000000000..02b318767
Binary files /dev/null and b/local-nuget/Google.Api.Gax.4.11.0.nupkg differ
diff --git a/local-nuget/Google.Api.Gax.Grpc.4.11.0.nupkg b/local-nuget/Google.Api.Gax.Grpc.4.11.0.nupkg
new file mode 100644
index 000000000..6d4f8e33a
Binary files /dev/null and b/local-nuget/Google.Api.Gax.Grpc.4.11.0.nupkg differ
diff --git a/local-nuget/Google.Api.Gax.Grpc.GrpcCore.4.11.0.nupkg b/local-nuget/Google.Api.Gax.Grpc.GrpcCore.4.11.0.nupkg
new file mode 100644
index 000000000..5aaba2869
--- /dev/null
+++ b/local-nuget/Google.Api.Gax.Grpc.GrpcCore.4.11.0.nupkg
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?><Error><Code>BlobNotFound</Code><Message>The specified blob does not exist.
+RequestId:111b5cf5-801e-0033-51f3-4ee25c000000
+Time:2025-11-06T08:00:59.9404934Z</Message></Error>
\ No newline at end of file
diff --git a/local-nuget/Google.Apis.1.69.0.nupkg b/local-nuget/Google.Apis.1.69.0.nupkg
new file mode 100644
index 000000000..4888f4dc8
Binary files /dev/null and b/local-nuget/Google.Apis.1.69.0.nupkg differ
diff --git a/local-nuget/Google.Apis.Auth.1.69.0.nupkg b/local-nuget/Google.Apis.Auth.1.69.0.nupkg
new file mode 100644
index 000000000..7a8fbef7e
Binary files /dev/null and b/local-nuget/Google.Apis.Auth.1.69.0.nupkg differ
diff --git a/local-nuget/Google.Apis.Core.1.69.0.nupkg b/local-nuget/Google.Apis.Core.1.69.0.nupkg
new file mode 100644
index 000000000..43f225543
Binary files /dev/null and b/local-nuget/Google.Apis.Core.1.69.0.nupkg differ
diff --git a/local-nuget/Google.Cloud.Iam.V1.3.4.0.nupkg b/local-nuget/Google.Cloud.Iam.V1.3.4.0.nupkg
new file mode 100644
index 000000000..ac8331964
Binary files /dev/null and b/local-nuget/Google.Cloud.Iam.V1.3.4.0.nupkg differ
diff --git a/local-nuget/Google.Cloud.Location.2.3.0.nupkg b/local-nuget/Google.Cloud.Location.2.3.0.nupkg
new file mode 100644
index 000000000..4a1a8331a
Binary files /dev/null and b/local-nuget/Google.Cloud.Location.2.3.0.nupkg differ
diff --git a/local-nuget/Google.LongRunning.3.3.0.nupkg b/local-nuget/Google.LongRunning.3.3.0.nupkg
new file mode 100644
index 000000000..35354adbd
Binary files /dev/null and b/local-nuget/Google.LongRunning.3.3.0.nupkg differ
diff --git a/local-nuget/Grpc.Core.2.46.6.nupkg b/local-nuget/Grpc.Core.2.46.6.nupkg
new file mode 100644
index 000000000..f726dde99
Binary files /dev/null and b/local-nuget/Grpc.Core.2.46.6.nupkg differ
diff --git a/local-nuget/Pkcs11Interop.4.1.0.nupkg b/local-nuget/Pkcs11Interop.4.1.0.nupkg
new file mode 100644
index 000000000..7ef0b3adc
Binary files /dev/null and b/local-nuget/Pkcs11Interop.4.1.0.nupkg differ
diff --git a/local-nuget/System.Management.7.0.2.nupkg b/local-nuget/System.Management.7.0.2.nupkg
new file mode 100644
index 000000000..59dffd135
Binary files /dev/null and b/local-nuget/System.Management.7.0.2.nupkg differ
diff --git a/src/__Libraries/StellaOps.Cryptography.Kms/AwsKmsFacade.cs b/src/__Libraries/StellaOps.Cryptography.Kms/AwsKmsFacade.cs
index c21125073..0e1d9a44b 100644
--- a/src/__Libraries/StellaOps.Cryptography.Kms/AwsKmsFacade.cs
+++ b/src/__Libraries/StellaOps.Cryptography.Kms/AwsKmsFacade.cs
@@ -5,7 +5,7 @@ using Amazon.KeyManagementService.Model;
 
 namespace StellaOps.Cryptography.Kms;
 
-internal interface IAwsKmsFacade : IDisposable
+public interface IAwsKmsFacade : IDisposable
 {
     Task<AwsSignResult> SignAsync(string keyResource, ReadOnlyMemory<byte> digest, CancellationToken cancellationToken);
 
@@ -16,11 +16,11 @@ internal interface IAwsKmsFacade : IDisposable
     Task<AwsPublicKeyMaterial> GetPublicKeyAsync(string keyResource, CancellationToken cancellationToken);
 }
 
-internal sealed record AwsSignResult(string KeyResource, string VersionId, byte[] Signature);
+public sealed record AwsSignResult(string KeyResource, string VersionId, byte[] Signature);
 
-internal sealed record AwsKeyMetadata(string KeyId, string Arn, DateTimeOffset CreatedAt, AwsKeyStatus Status);
+public sealed record AwsKeyMetadata(string KeyId, string Arn, DateTimeOffset CreatedAt, AwsKeyStatus Status);
 
-internal enum AwsKeyStatus
+public enum AwsKeyStatus
 {
     Unspecified = 0,
     Enabled = 1,
@@ -31,7 +31,7 @@ internal enum AwsKeyStatus
     Unavailable = 6,
 }
 
-internal sealed record AwsPublicKeyMaterial(string KeyId, string VersionId, string Curve, byte[] SubjectPublicKeyInfo);
+public sealed record AwsPublicKeyMaterial(string KeyId, string VersionId, string Curve, byte[] SubjectPublicKeyInfo);
 
 internal sealed class AwsKmsFacade : IAwsKmsFacade
 {
diff --git a/src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsFacade.cs b/src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsFacade.cs
index a8bc19aec..f8d16075f 100644
--- a/src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsFacade.cs
+++ b/src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsFacade.cs
@@ -4,7 +4,7 @@ using Google.Protobuf.WellKnownTypes;
 
 namespace StellaOps.Cryptography.Kms;
 
-internal interface IGcpKmsFacade : IDisposable
+public interface IGcpKmsFacade : IDisposable
 {
     Task<GcpSignResult> SignAsync(string versionName, ReadOnlyMemory<byte> digest, CancellationToken cancellationToken);
 
@@ -15,11 +15,11 @@ internal interface IGcpKmsFacade : IDisposable
     Task<GcpPublicKeyMaterial> GetPublicKeyAsync(string versionName, CancellationToken cancellationToken);
 }
 
-internal sealed record GcpSignResult(string VersionName, byte[] Signature);
+public sealed record GcpSignResult(string VersionName, byte[] Signature);
 
-internal sealed record GcpCryptoKeyMetadata(string KeyName, string? PrimaryVersionName, DateTimeOffset CreateTime);
+public sealed record GcpCryptoKeyMetadata(string KeyName, string? PrimaryVersionName, DateTimeOffset CreateTime);
 
-internal enum GcpCryptoKeyVersionState
+public enum GcpCryptoKeyVersionState
 {
     Unspecified = 0,
     PendingGeneration = 1,
@@ -32,13 +32,13 @@ internal enum GcpCryptoKeyVersionState
     GenerationFailed = 8,
 }
 
-internal sealed record GcpCryptoKeyVersionMetadata(
+public sealed record GcpCryptoKeyVersionMetadata(
     string VersionName,
     GcpCryptoKeyVersionState State,
     DateTimeOffset CreateTime,
     DateTimeOffset? DestroyTime);
 
-internal sealed record GcpPublicKeyMaterial(string VersionName, string Algorithm, string Pem);
+public sealed record GcpPublicKeyMaterial(string VersionName, string Algorithm, string Pem);
 
 internal sealed class GcpKmsFacade : IGcpKmsFacade
 {
diff --git a/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Facade.cs b/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Facade.cs
index fb3fd3705..4291dfb7f 100644
--- a/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Facade.cs
+++ b/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Facade.cs
@@ -1,13 +1,20 @@
 using Net.Pkcs11Interop.Common;
 using Net.Pkcs11Interop.HighLevelAPI;
 using Net.Pkcs11Interop.HighLevelAPI.MechanismParams;
+using Pkcs11 = Net.Pkcs11Interop.HighLevelAPI.Pkcs11;
+using Slot = Net.Pkcs11Interop.HighLevelAPI.Slot;
+using ISession = Net.Pkcs11Interop.HighLevelAPI.Session;
+using ObjectHandle = Net.Pkcs11Interop.HighLevelAPI.ObjectHandle;
+using ObjectAttribute = Net.Pkcs11Interop.HighLevelAPI.ObjectAttribute;
+using Mechanism = Net.Pkcs11Interop.HighLevelAPI.Mechanism;
 using System.Collections.Concurrent;
 using System.Formats.Asn1;
 using System.Security.Cryptography;
+using Microsoft.IdentityModel.Tokens;
 
 namespace StellaOps.Cryptography.Kms;
 
-internal interface IPkcs11Facade : IDisposable
+public interface IPkcs11Facade : IDisposable
 {
     Task<Pkcs11KeyDescriptor> GetKeyAsync(CancellationToken cancellationToken);
 
@@ -16,12 +23,12 @@ internal interface IPkcs11Facade : IDisposable
     Task<byte[]> SignDigestAsync(ReadOnlyMemory<byte> digest, CancellationToken cancellationToken);
 }
 
-internal sealed record Pkcs11KeyDescriptor(
+public sealed record Pkcs11KeyDescriptor(
     string KeyId,
     string? Label,
     DateTimeOffset CreatedAt);
 
-internal sealed record Pkcs11PublicKeyMaterial(
+public sealed record Pkcs11PublicKeyMaterial(
     string KeyId,
     string Curve,
     byte[] Qx,
@@ -57,11 +64,11 @@ internal sealed class Pkcs11InteropFacade : IPkcs11Facade
             throw new InvalidOperationException("PKCS#11 private key not found.");
         }
 
-        var labelAttr = GetAttribute(session, privateHandle.Value, CKA.CKA_LABEL);
+        var labelAttr = GetAttribute(session, privateHandle, CKA.CKA_LABEL);
         var label = labelAttr?.GetValueAsString();
 
         return new Pkcs11KeyDescriptor(
-            KeyId: label ?? privateHandle.Value.ObjectId.ToString(),
+            KeyId: label ?? privateHandle.ObjectId.ToString(),
             Label: label,
             CreatedAt: DateTimeOffset.UtcNow);
     }
@@ -76,9 +83,9 @@ internal sealed class Pkcs11InteropFacade : IPkcs11Facade
             throw new InvalidOperationException("PKCS#11 public key not found.");
         }
 
-        var pointAttr = GetAttribute(session, publicHandle.Value, CKA.CKA_EC_POINT)
+        var pointAttr = GetAttribute(session, publicHandle, CKA.CKA_EC_POINT)
             ?? throw new InvalidOperationException("Public key missing EC point.");
-        var paramsAttr = GetAttribute(session, publicHandle.Value, CKA.CKA_EC_PARAMS)
+        var paramsAttr = GetAttribute(session, publicHandle, CKA.CKA_EC_PARAMS)
             ?? throw new InvalidOperationException("Public key missing EC parameters.");
 
         var ecPoint = ExtractEcPoint(pointAttr.GetValueAsByteArray());
@@ -92,8 +99,8 @@ internal sealed class Pkcs11InteropFacade : IPkcs11Facade
         var qx = ecPoint.AsSpan(1, coordinateSize).ToArray();
         var qy = ecPoint.AsSpan(1 + coordinateSize, coordinateSize).ToArray();
 
-        var keyId = GetAttribute(session, publicHandle.Value, CKA.CKA_LABEL)?.GetValueAsString()
-            ?? publicHandle.Value.ObjectId.ToString();
+        var keyId = GetAttribute(session, publicHandle, CKA.CKA_LABEL)?.GetValueAsString()
+            ?? publicHandle.ObjectId.ToString();
 
         return new Pkcs11PublicKeyMaterial(
             keyId,
@@ -110,7 +117,7 @@ internal sealed class Pkcs11InteropFacade : IPkcs11Facade
             ?? throw new InvalidOperationException("PKCS#11 private key not found.");
 
         var mechanism = new Mechanism(_options.MechanismId);
-        return session.Sign(mechanism, privateHandle.Value, digest.ToArray());
+        return session.Sign(mechanism, privateHandle, digest.ToArray());
     }
 
     private async Task<SessionContext> OpenSessionAsync(CancellationToken cancellationToken)
diff --git a/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11KmsClient.cs b/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11KmsClient.cs
index 82e139dc1..7540033ad 100644
--- a/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11KmsClient.cs
+++ b/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11KmsClient.cs
@@ -1,6 +1,7 @@
 using System.Collections.Concurrent;
 using System.Collections.Immutable;
 using System.Security.Cryptography;
+using Microsoft.IdentityModel.Tokens;
 
 namespace StellaOps.Cryptography.Kms;
 
diff --git a/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Options.cs b/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Options.cs
index bea3f867b..9a2a0a40b 100644
--- a/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Options.cs
+++ b/src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Options.cs
@@ -64,7 +64,7 @@ public sealed class Pkcs11Options
     /// <summary>
     /// Gets or sets an optional factory for advanced facade injection (testing, custom providers).
     /// </summary>
-    internal Func<IServiceProvider, IPkcs11Facade>? FacadeFactory { get; set; }
+    public Func<IServiceProvider, IPkcs11Facade>? FacadeFactory { get; set; }
 
     private static TimeSpan EnsurePositive(TimeSpan value, TimeSpan fallback)
         => value <= TimeSpan.Zero ? fallback : value;
diff --git a/src/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.csproj b/src/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.csproj
index a54b07dd9..02195e3f0 100644
--- a/src/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.csproj
+++ b/src/__Libraries/StellaOps.Cryptography.Kms/StellaOps.Cryptography.Kms.csproj
@@ -9,7 +9,7 @@
     <PackageReference Include="Microsoft.Extensions.Options" Version="9.0.0" />
     <PackageReference Include="AWSSDK.KeyManagementService" Version="4.0.6" />
     <PackageReference Include="Google.Cloud.Kms.V1" Version="3.19.0" />
-    <PackageReference Include="Pkcs11Interop" Version="5.3.0" />
+    <PackageReference Include="Pkcs11Interop" Version="4.1.0" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="../StellaOps.Cryptography/StellaOps.Cryptography.csproj" />