Securely doesn't equate to what a HSM provides. I'd be doubtful if they are (using them) right now... If IAM gets compromised, an attacker can take the key and

Securely doesn't equate to what a HSM provides. I'd be doubtful if they are (using them) right now... If IAM gets compromised, an attacker can take the key and run, opposed to them only being able to use it while they have access to the HSM. Not saying it's likely to happen.