That's not how HSMs work or they would be totally useless. Short of a hidden vulnerability or a manufacturing defect there's no "official" way to physically ac

That's not how HSMs work or they would be totally useless. Short of a hidden vulnerability or a manufacturing defect there's no "official" way to physically access data from the device without destroying it. And accessing the data the normal way still requires access the cloud provider doesn't have (a certificate password for example). If we're talking hackers that could successfully hack an HSM, they don't really care about laws. And if we're talking about acting under some law, that law has to compel the owner of the password to give it up. Not the cloud provider.