The problem with the "just use an HSM" advice

2026-01-26

That advice assumes a static environment. Real systems scale, rotate staff, add services, and change trust assumptions. Hardware alone doesn't solve governance.