refer to #299 , tokengen can be used for production environment if the private key is not in the msp folder ( i.e. generated in an hsm token slot ) . so is tokengen supported for private keys not already presented in msp directory ?