Developers can build a software HSM workflow using SoftHSM2 as a PKCS#11 token provider, managed with OpenSC tools like `pkcs11-tool`. The core goal is to perform encryption and decryption from Python while ensuring the private key never leaves the token. This approach mimics hardware security module behavior for key storage and cryptographic operations.

The process starts with installing SoftHSM2 and OpenSC, then initializing a token with a user PIN. Using `pkcs11-tool`, you generate an RSA key pair, keeping the private key non-exportable. For real-world use, a hybrid encryption pattern is recommended: encrypt data with AES-GCM and wrap the AES key with the RSA public key. The private key in SoftHSM2 decrypts the AES key via PKCS#11 calls.

This workflow is vital for applications needing to comply with strict key management policies without investing in physical hardware. It demonstrates a standard PKCS#11 integration, where Python libraries like `python-pkcs11` handle the session and decrypt operations. However, as a software HSM, its security relies entirely on host file permissions and system hardening, not physical tamper resistance.