We also use an HSM. Smart cards are held by two separate people, each card set is different. Both have to be present to restart the HSM. Our HSM can require u

We also use an HSM. Smart cards are held by two separate people, each card set is different. Both have to be present to restart the HSM. Our HSM can require up to five different cards be required for certain operations. For us, we only require two for normal operations. For HSM management (key generation, card authentication, etc..) we require a third card set member to be present. This protects against accidental key erasure, or fraud.