They didn't use a HSM?? I know keys can be exported even from those but they are built for lots of money to prevent exactly that.
https://azure.microsoft.com/en-us/products/azure-dedicated-h...
A very small number of people should have access to their HSMs. This shouldn’t be too hard to figure out.