IIRC you are able to get the cert signed to an existing HSM USB (depends on the provider tho).