In terms of YubiHSM, they make two versions, the non-FIPS and the FIPS. My original post was made with the non-FIPS version in mind, which is effectively a non

In terms of YubiHSM, they make two versions, the non-FIPS and the FIPS. My original post was made with the non-FIPS version in mind, which is effectively a non-certified glorified Yubikey that just has different firmware that allows HSM-esque functionality such as key-wrap, and a more API-friendly interface even if the documentation is terrible. :) I agree that for FIPS/CC, by all means charge what you like for the certification badge, since any company that needs the compliance tick-box will pay whatever price is asked. My beef is more with the non-certified pricing. Ultimatley the problem is when you clearly need more than one, and ideally minimum of three or five units in order to achieve suitable hardware redundancy. The sort of people I have in mind would be private individuals (e.g. freelance developer, OSS-project maintainer etc.) and SME-sized companies and non-profit organisations for whom 3x650 or 5x650 could be financially unattractive or even plain financially impossible. Perhaps we could meet half-way and you could have basic functionality and then more advanced functionality and/or increased storage capacity unlockable through software licensing on a pay-as-you-go model ? As long as the fees were one-off and not yet-another-company-selling-a-subscription-pricing-model.