An alternate path to install the tokend driver in /Library/Security/tokend. I don’t believe that directory is created, so you’ll need to go to /Library/Security/ and create the /tokend directory. But that takes care of the rootless protection. I created the directory and my smart card is being read properly by the system and Keychain Access. I was then able to successfully configure Outlook 2011 with the certs on my smart card and send signed and encrypted emails.
As for getting the PIN caching to prompt correctly, why not disable PIN caching altogether? For security purposes, it would be more effective to enter your PIN each time. I know myself and many others wouldn’t mind that if that means it is working properly and managing the certs and smart card accordingly.
Thanks,
Ben