docs: drop openssl-tpm2-engine in favor of PKCS#11

[joshdrake]

Closes EFF-473.

Why

The Ubuntu install step told readers to apt-get install step-agent openssl-tpm2-engine, and the agent's PKCS#11 section opened by pointing them at OpenSSL's tpm2-openssl provider / libtpm2-tss as the integration path. Neither matches how the agent actually works.

Verified against origin/main of smallstep/agent:

• openssl-tpm2-engine was never a step-agent package dependency. git log -S across all refs returns zero hits; the string appears nowhere in the agent repo. The docs line has been advisory since it was added in Nov 2024, and nothing ever consumed it.
• The Linux packages declare PKCS#11 deps instead (.goreleaser.yml): deb → p11-kit, p11-kit-modules, libengine-pkcs11-openssl; rpm → p11-kit, openssl-pkcs11. Only Arch/Nix declare tpm2-openssl, which is the tpm2-software provider — a different project from openssl-tpm2-engine.
• All agent-driven network auth moved to the built-in PKCS#11 server — smallstep/agent#1056 ("Always use pkcs11 server with network manager") and smallstep/agent#1072 ("Use pkcs11 for EAPoL on Linux").

What changed

• Ubuntu install — drop openssl-tpm2-engine, making the step identical to Debian's.
• Rename OpenSSL and PKCS#11 support → PKCS#11 support, and lead with the PKCS#11 server as the supported integration point for NetworkManager, wpa_supplicant, VPN clients, and browsers.
• Document the auto-registered p11-kit module. The Linux packages install /etc/pkcs11/modules/step-agent.module (agent v0.67.4+), so p11-kit-aware software needs no manual setup. NSS apps (Chrome, Firefox) still need the modutil step, which is called out explicitly.
• Fix the socket path in all 5 places. It is /run/step-agent/step-agent-pkcs11.sock, not $XDG_RUNTIME_DIR/step-agent/step-agent-pkcs11.sock. extra/step-agent.service hard-sets RUNTIME_DIRECTORY=/run/step-agent, and extra/step-agent.module, extra/wpa_supplicant-step-agent.conf, and pkg/pkcs11server/README.md all independently agree. The old path was wrong even in the user-session fallback, which joins the filename directly to $XDG_RUNTIME_DIR with no step-agent subdirectory.
• Update the two troubleshooting links to the renamed #pkcs11-support anchor.

No manifest.json change and no redirect needed — the page URL is unchanged, only an in-page anchor moved.

Verification

• grep confirms zero remaining openssl-tpm2-engine, openssl-and-pkcs11-support, or $XDG_RUNTIME_DIR/step-agent in any .mdx.
• Vale output is byte-identical before and after (5 errors, 3 warnings, all pre-existing on untouched lines).
• Anchors validated against github-slugger, the same slugger rehype-slug uses on the site: PKCS#11 support → pkcs11-support. Cross-checked the rule against two existing working links. All 8 inbound anchors to smallstep-agent.mdx resolve.

Notes for the reviewer

• Conflicts with docs/pkcs11-modutil-order (unmerged), which rewrites the same section to reorder export P11_KIT_SERVER_ADDRESS before modutil -add. I deliberately did not duplicate that fix — whichever lands second should resolve.
• The section is scoped to Linux on purpose. macOS resolves to a different socket path and integrates via CryptoTokenKit; nothing in the agent tree consumes the macOS socket, so I did not document it.

Out of scope, worth follow-ups

• packages.smallstep.com/containers/Dockerfile.ubuntu:13 still runs apt-get -y install step-agent-plugin openssl-tpm2-engine step-cli — stale on two counts, since the current package name is step-agent. The debian/fedora/centos sibling Dockerfiles don't install it.
• smallstep/openssl_tpm2_engine's debian/control has the wrong Homepage/Vcs-Git (points at tpm2-software/tpm2-openssl, a different project).
• 11 pre-existing broken cross-file anchors elsewhere in the docs (step-ca/, certificate-manager/), surfaced by the anchor check I ran. Untouched here.

🤖 Generated with Claude Code

https://claude.ai/code/session_012CzzkgZ1fM8x5AdmMFhE6v

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}