The pkcs11 group is created by the RPM scriptlet.

Index: opencryptoki-2.2.8/usr/sbin/pkcs11_startup/pkcs11_startup.in
===================================================================
--- opencryptoki-2.2.8.orig/usr/sbin/pkcs11_startup/pkcs11_startup.in
+++ opencryptoki-2.2.8/usr/sbin/pkcs11_startup/pkcs11_startup.in
@@ -309,29 +309,29 @@ rm -f @CONFIG_PATH@/@CONFIG_FILE@ >/dev/
 		        # it from scratch
 
 
-# Create the pkcs11 group if it does not exist...
-cat /etc/group|grep pkcs11 >/dev/null 2>&1
-rc=$?
-if [ $rc = 1 ]
-then
-   if [ -x @GROUPADD@ ]
-   then
-	   @GROUPADD@ pkcs11 >/dev/null 2>&1
-
-   else
-	   echo "Couldn't execute @GROUPADD@. Please add the group 'pkcs11' manually."
-   fi
-fi
-
-
-if [ -x @USERMOD@ -a -x @ID@ ]
-then
-	# add the pkcs group
-	# replace spaces by commas
-	@USERMOD@ -G $( @ID@ --groups --name root | /bin/sed -e 'y/ /,/'),pkcs11  root
-else
-	echo "Couldn't execute @USERMOD@. Please add root to the group 'pkcs11' manually."
-fi
+## Create the pkcs11 group if it does not exist...
+#cat /etc/group|grep pkcs11 >/dev/null 2>&1
+#rc=$?
+#if [ $rc = 1 ]
+#then
+#   if [ -x @GROUPADD@ ]
+#   then
+#	   @GROUPADD@ pkcs11 >/dev/null 2>&1
+#
+#   else
+#	   echo "Couldn't execute @GROUPADD@. Please add the group 'pkcs11' manually."
+#   fi
+#fi
+#
+#
+#if [ -x @USERMOD@ -a -x @ID@ ]
+#then
+#	# add the pkcs group
+#	# replace spaces by commas
+#	@USERMOD@ -G $( @ID@ --groups --name root | /bin/sed -e 'y/ /,/'),pkcs11  root
+#else
+#	echo "Couldn't execute @USERMOD@. Please add root to the group 'pkcs11' manually."
+#fi
 
 
 # For each card run the status command and if successful