If what you need is the management of 16 different NIST P-curve keys and nothing else, and you don't necessarily care if the whole package is secure against DPA, that part is a cheap way to get that.

But that's not what people on this thread are asking for; they want it to do all the crypto stuff they do normally, with all the keys secured in hardware.

I'm a little out of my depth on this stuff; I've done chipset work but my part of those projects always starts with the C code. Maybe you can accomplish what you want with a cheap crypto IC. I'm really just pushing back on the idea that because you can build a smartphone out of a cheap ARM core, you can also build an HSM out of one.