[jacquesm]

> They did, with undocumented commands, export the key from the device in an unencrypted format and loaded it into the other model so that we could continue our operation.

NDA or not, that company should be put out of business. Essentially they've backdoored that HSM.

Assuming it is true this is far bigger news than the article you wrote.