I'm not sure about the YubiHSM, but it is considered good (essential?) practice to have a hardware signature counter, so you can tell if there were signatures t

I'm not sure about the YubiHSM, but it is considered good (essential?) practice to have a hardware signature counter, so you can tell if there were signatures that done outside of your normal-process (which, if important, would document those). So, you'd know if there are bad signatures out there; If your process documents all signatures, you'd even know which ones are bad (because they are bad in the audit trail or do not appear there at all). Yubikeys have such a counter, so I'd be surprised if the YubiHSM doesn't.