Here's a D.I.Y. one that looks like a fun project: https://cryptosense.com/blog/building-a-raspberry-pi-hsm-for-rsa-2014/ https://cryptosense.com/blog/building

Here's a D.I.Y. one that looks like a fun project: https://cryptosense.com/blog/building-a-raspberry-pi-hsm-for-rsa-2014/ https://cryptosense.com/blog/building-a-raspberry-pi-hsm-for... The Nitrokey HSM is what the guardian project recommends and is super affordable actually: https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 Edit: Changed from "what cloudflare uses" to "what the guardian project recommends"[1]. I was reading too many tabs at once and confused things. https://guardianproject.info/2017/12/18/building-a-signing-server/ https://guardianproject.info/2017/12/18/building-a-signing-s... Sorry to jgrahamc for the incorrect endorsement.