[late2part]

I'm pretty happy with this solution from Strongauth.

http://keyappliance.strongauth.com/

You can secure the root for it with TPM or HSM.

[kkamperschroer]

That's an interesting solution. I guess this would really only work though if you are self hosted, right?

Thanks!