I lately dealt with some infrastructure issue, involving HSM. Literally "we have HSMs and they're secure", except they don't work, and audit logs are non-existi

I lately dealt with some infrastructure issue, involving HSM. Literally "we have HSMs and they're secure", except they don't work, and audit logs are non-existing. And if you enable them, they sometimes work (mostly not), and give output in some undocumented binary format. Not fun experience.