A blog post by Mozilla on the topic of package signing with an HSM:

https://blog.mozilla.org/security/2013/02/13/using-cryptosti...