The Aladdin Etoken looks pretty nice. It seems that their FIPS 140-2 Level 3 is basically a full blown HSM. However, it's the same company that makes CRYPTOCar

The Aladdin Etoken looks pretty nice. It seems that their FIPS 140-2 Level 3 is basically a full blown HSM. However, it's the same company that makes CRYPTOCard (do a search for "fortezza" to read up on the history). Edit: The parent to this post originally said "Aladdin Etoken" instead of "open source soft tokens". Open source software tokens aren't really acceptable since you need to run them on a multi-purpose device which has several paths to exploit. It's not a "false dichotomy" if there aren't any reasonable options. I'm not willing to settle for a device that doesn't solve the only problem it exists for.