I am a rent-a-programmer *** Beogradsko programiranje ***
pkcs11 enabled usb as hsm
https://banzaicloud.com/blog/vault-hsm/
https://github.com/opendnssec/SoftHSMv2
https://techblog.cisco.com/blog/vault-hsm