Is the proper way to distinguish between keys that are more temporary/stored in volatile memory and those stored in non-volatile memory to label them "session objects" or "token objects" using the CKA_TOKEN attribute?
Yes, temporary keys are indeed session objects.
Or is there another attribute or property in the spec that I am missing?
No there is no other property that I know of. Just setting
false should do the trick.
If a power-off event occurs for a device, is it valid to consider that to be an event which closes the session and allows session objects to be destroyed?
Absolutely. I'd be very annoyed if a FIPS or Common Criteria verified product would not invalidate sessions on reboot (or, more likely, automatically remove all sessions on power off).
When the power is off the token may be transported to Siberia without the device noticing this. Clearly this should be reason to invalidate a session.
Destruction of keys when they are no longer needed are strong requirements both for FIPS and Common Criteria.