anchor.diff:  recovering PIV tokens (i.e. replacing a PIV token), creating new recovery
   tokens for a PIV token, and providing the PIN of a PIV token.
   
  -When a pivtoken is added, the KBMAPI service generates a recovery
  +When a PIV token is added, the KBMAPI service generates a recovery
   token (a 32 byte blob of random data) that will be stored on the CN.  The
   recovery token is limited to 32 bytes due to limitations in the Shamir secret
   sharing code used during recovery.  As described in XXX, normally the PIV
  
positive.code: 
  | pubkeys
  | Yes
  | A JSON object containing the _public_ keys of the pivtoken
  
  | pubkeys.9a
  | Yes
  | The public key used for authentication after the pivtoken has been unlocked.
  
  | pubkeys.9d
  | Yes
  | The public key used for encryption after the pivtoken has been unlocked.
  
  | pubkeys.9e
  | Yes
  | The public key used for authenticating the pivtoken itself without a pin (e.g.
  used when requesting the pin of a pivtoken).
  
  | attestation
  | No
  
negative.code: 
  Deletes information about a PIV token.  This would be called during the
  decommission process of a CN.  The request is authenticated using the 9e
  key of the PIV token.
  
  Sample request:
  
  