> HSM's require I'm sure some very rigorous development and testing. I think they mostly require an outside evaluator to do a sort of documentation process tha

> HSM's require I'm sure some very rigorous development and testing. I think they mostly require an outside evaluator to do a sort of documentation process that costs somewhere around $500k depending on complexity on a new product, and maybe $50k just for up-versioning. It's generally hard to get that money back on a product since the market of organizations that need the certification is tiny and then the larger overall market for a security product is also usually small and not so happy to defray those costs.