Not a direct solution but to put two walk arounds on record:

1) boot GRML to RAM and install needed packages from Debian unstable.

2) stop graphical ui, stop database etc daemons, remount / read-only, and write key to ram disk.

Richard

PS: what kind of smart card is sold as secure and does not support on-card key generation?

PPS: think of revocation key! If they lose that card...

PPPS: feel free to forward to whoever needs this info.

Sent by mobile; excuse my brevity.