[danuker]

It's not so extreme, you have to trust the HSM manufacturer.

Try generating randomness using casino-grade dice, and xor-ing it with the HSM. Maybe then.

[xxpor]

Now I'm wondering who's managed to pull off supply chain attacks on dice, since I'm sure it's happened already.