Solution: p11-kit

p11-kit provides functions to coordinate initialization and finalization of any PKCS#11 module. A module may be initialized any number of times using the p11_kit_initialize_module() function. The first time that p11_kit_initialize_module() is called for a module, that module's C_Initialize function is used. Later invocations for the same module cause p11-kit to increment an internal initialization count, rather than calling C_Initialize again.

The p11_kit_finalize_module() is used to finalize a module. Each time it is called it decrements the internal initialization count for that module. When the internal initialization count reaches zero, the module's C_Finalize function is called.

This is done in a thread-safe manner. These functions can be used on modules that the consumer loads themselves.