[cpach]

Yes, but you can outsource that part to Digicert et al, so that you don’t need to buy the HSM yourself.