[kfreds]

Yes, except YubiHSM boots using verified boot. In the case of Tillitis Key each program gets its own secret key, which it can use to e.g. derive a key pair.