> You don't want operation to stop because someone dropped something in the floor, bumped into the rack or if a minor earthquake occurred. Sounds like you just

> You don't want operation to stop because someone dropped something in the floor, bumped into the rack or if a minor earthquake occurred. Sounds like you just need a fault-tolerant cluster of HSMs distributed across regions/AZs. The fact that you only need one up and signing for the cluster to serve its function, would mean that any given HSM would be free to be as finicky as it wants, and thereby lock up and need to be reset+re-enrolled into the cluster as often as it wants. (I would note that Google Cloud, at least, seems to use this "cluster of HSMs" approach for Identity-Aware Proxy request-signing — there's no other reason that their JWKS endpoint would be serving 8+ distinct active keys.)