Thank you for the detailed response! Lots of good perspectives. Ryan Hurst is great. I ended up spending several hours with him at CCS talking about HSMs. I w

Thank you for the detailed response! Lots of good perspectives. Ryan Hurst is great. I ended up spending several hours with him at CCS talking about HSMs. I was mostly upstairs at CATS due to two other projects I'm involved with - Sigsum and System Transparency. Sigsum is a minimal transparency log design which uses proactive cosigning witnessing to mitigate split view attacks. In collaboration with TrustFabric (Al, Martin et al) and Filippo Valsorda we have achieved consensus on the cryptographic semantics of the witnesses, so all of us met at CATS to discuss the bootstrapping of a witness ecosystem. I'd love to learn more about some of the things you mention! * What standards do you consider better than FIPS in this context? * When you say "ideally there would be something better", what would you like to have? Something else to consider: Performance. TKey is RV32ICZmmul running at 20-ish MHz, with the on-board 16x16 bit DSPs to accelerate the multiplication instructions. If you need more than a few ECC signatures per second then you need something more powerful than the TKey. You've already mentioned the USB Armory II elsewhere in this thread so I'm sure you've already thought of it. I'll point it out here explicitly so others might benefit as well: The USB Armory II looks to be a fantastic flexible HSM substrate. Andrea Barisani et al's work on getting it to run Go is genius. Go as firmware is genius for that matter (see TinyGo).