I've built a generic PKCS#11 interface to the Apple's Secure Enclave[1]

Primarily to use in conjunction with OpenVPN. Like secretive or /usr/lib/ssh-keychain.dylib[2], but not just for SSH.

1 - https://github.com/ne-bknn/nailed

2 - https://news.ycombinator.com/item?id=46025721