// Create the key
	CK_BBOOL boolTrue = CK_TRUE;

	CK_ATTRIBUTE generateTemplate[] = {
		{CKA_TOKEN, &boolTrue, sizeof(boolTrue)},
		{CKA_UNWRAP, &boolTrue, sizeof(boolTrue)},
	};
	CK_ULONG generateCount = sizeof(generateTemplate) / sizeof(CK_ATTRIBUTE);
	CK_MECHANISM mech = {
		CKM_BLOCKDAEMON_WRAPPING_KEYS_GEN,
		NULL_PTR,
		0
	};
	CK_OBJECT_HANDLE wrappingKeysHandle;
	CK_RV rv = f->C_GenerateKey(session, &mech, generateTemplate, generateCount, &wrappingKeysHandle);
	if (rv != CKR_OK) {
		return rv
	}

	// Extract the wrapping keys from the generated key object
	CK_BYTE wrappingKeys[3000];
	CK_ATTRIBUTE getTemplate[] = {
    {CKA_BLOCKDAEMON_JSON_WRAPPING_KEYS, wrappingKeys, sizeof(wrappingKeys)-1},
	};
	CK_ULONG getCount = sizeof(getTemplate) / sizeof(CK_ATTRIBUTE);

	rv = f->C_GetAttributeValue(session, wrappingKeysHandle, getTemplate, getCount);
	if (rv != CKR_OK) {
		return rv
	}

	// The following line is optional, but will add a zero termination to the string.
	// This is also the reason for the -1 in the template above as this ensures there is room.
  wrappingKeys[getTemplate[0].ulValueLen] = '\0';

	// The input for this code (keyshare can be for other player IDs depending on the config):
	wrappingKeys := // JSON exported from the PKCS #11 module

	var wrappingKeyMap map[int][]byte
	err := json.Unmarshal([]byte(wrappingKeysJSON), &wrappingKeyMap)
	if err != nil { panic(err) }

{
	"0":"BASE64Encoding==",
	"1":"BASE64Encoding==",
	"2":"BASE64Encoding=="
}

{
	"wrapped-key-shares":{
		"0":"BASE64Encoding==",
		"1":"BASE64Encoding==",
		"2":"BASE64Encoding=="
	},
	"check-value":"BASE64Encoding=="
}

	// Variables with input:
	wrappedKeyShares := // Map of wrapped key shares for the different players
	checkValue := // The check value as defined for this key type	

	type WrappedKey struct {
		WrappedKeyShares map[int][]byte `json:"wrapped-key-shares"`
		CheckValue       []byte         `json:"check-value"`
	}

	var jsonStruct WrappedKey
	jsonStruct.CheckValue = checkValue
	jsonStruct.WrappedKeyShares = make(map[int][]byte)
	jsonStruct.WrappedKeyShares[0] = wrappedKeyShares[0]
	jsonStruct.WrappedKeyShares[1] = wrappedKeyShares[1]
	jsonStruct.WrappedKeyShares[2] = wrappedKeyShares[2]

	wrappedKeysJSON, err := json.Marshal(jsonStruct)
	if err != nil { panic(err) }

	// Variables with input:
	client := // The Builder Vault SDK client
	sessionConfig := // Session config for this operation
	keyID := // KeyID of the key to export
	playerID := // The ID of the player of this client as a string
	wrappingKeyMap := // The parsed JSON Wrapping key map
	wrappedKeyShares := // The map that contains the wrapped keyshares (output)

	wrappedKeyShare, err := client.RSA().ExportKey(context.Background(), sessionConfig, keyID,
                                                 wrappingKeyMap[playerID])
	if err != nil { panic(err) }

	wrappedKeyShares[playerID] = wrappedKeyShare.WrappedKeyShare
	checkValue := wrappedKeyShare.PKIXPublicKey

	// Variables with input:
	privateKey := // The *rsa.Private key to make encrypted shares for
	players := // An []int array of players that the key should be split bewteen, e.g. []int{0,1,2}

	publicKey := privateKey.Public()
	keyShares, err := tsmutils.RSASecretShare(2, players, privateKey)
	if err != nil { panic(err) }

	wrappedKeyShares := make(map[int][]byte, 3)
	for k, v := range keyShares {
		wrappingKey, err := x509.ParsePKIXPublicKey(wrappingKeyMap[k])
		if err != nil { panic(err) }

		rsaWrappingKey, ok := wrappingKey.(*rsa.PublicKey)
		if !ok { panic("not an RSA key") }

		wrappedKeyShares[k], err = tsmutils.EnvelopeWrap(rsaWrappingKey, v)
		if err != nil { panic(err) }
	}

	checkValue, err := x509.MarshalPKIXPublicKey(publicKey)
	if err != nil { panic(err) }

	// Variables with input:
	client := // The Builder Vault SDK client
	sessionConfig := // Session config for this operation
	keyID := // KeyID of the key to export
	playerID := // The ID of the player of this client as a string
	wrappingKeyMap := // The parsed JSON Wrapping key map
	wrappedKeyShares := // The map that contains the wrapped keyshares (output)

	wrappedKeyShare, err := client.AES().ExportKey(context.Background(), sessionConfig, keyID,
                                                 wrappingKeyMap[playerID])
	if err != nil { panic(err) }

	wrappedKeyShares[playerID] = wrappedKeyShare.WrappedKeyShare
	checkValue := wrappedKeyShare.Checksum

	// Variables with input:
	aesKey := // The []byte key to make encrypted shares for
	players := // An []int array of players that the key should be split bewteen, e.g. []int{0,1,2}

	keyShares, err := tsmutils.AESSecretShare(players, aesKey)
	if err != nil { panic(err) }

	wrappedKeyShares := make(map[int][]byte, 3)
	for k, v := range sharing.Shares {
		wrappingKey, err := x509.ParsePKIXPublicKey(wrappingKeyMap[k])
		if err != nil { panic(err) }

		rsaWrappingKey, ok := wrappingKey.(*rsa.PublicKey)
		if !ok { panic("not an RSA key") }

		wrappedKeyShares[k], err = tsmutils.Wrap(rsaWrappingKey, v)
		if err != nil { panic(err) }
	}

	checkValue, err := sharing.Checksum
	if err != nil { panic(err) }

	// Variables with input:
  wrappedKeysJSON = // Insert the json generated with the wrapped key shares and check value
  wrappingKeysHandle = // The handle for the key generated in the first step, or recreated before this

	CK_MECHANISM unwrapMechanism = {
		CKM_BLOCKDAEMON_MPC_UNWRAP,
		NULL_PTR,
		0,
  };
	// This is an example of AES, for RSA an RSA specific template should be used.
	// Also other attributes can be set like e.g. CKA_LABEL.
	CK_OBJECT_CLASS clazz = CKO_SECRET_KEY;
	CK_KEY_TYPE type = CKK_AES;
	CK_ULONG keyLength = 32;
	CK_ATTRIBUTE unwrapTemplate[] = {
		{CKA_CLASS, &clazz, sizeof(clazz)},
		{CKA_KEY_TYPE, &type, sizeof(type)},
		{CKA_TOKEN, &boolTrue, sizeof(boolTrue)},
		{CKA_VALUE_LEN, &keyLength, sizeof(keyLength)},
		{CKA_ENCRYPT, &boolTrue, sizeof(boolTrue)}
	};
	// The -1 after sizeof(wrappedKeysJSON) is needed if the parameter is given as a string,
	// otherwise it should be removed.
	CK_OBJECT_HANDLE unwrappedKeyHandle;
	rv = f->C_UnwrapKey(session, &unwrapMechanism, wrappingKeysHandle, (unsigned char*) wrappedKeysJSON,
	                    sizeof(wrappedKeysJSON)-1, unwrapTemplate, 5, &unwrappedKeyHandle);
	if (rv != CKR_OK) {
		return rv
	}