I don't get why companies that large would bother considering not using HSMs. Basically it's about public-key encryption, even if https is not ideal, it's quite a widespread implementation that can be sufficiently secure for many use cases