And they support ACME. I've been running a smallstep CA off of a Nitrokey HSM 2[1] w/ PKCS #11 for my homelab for a few years now
1. https://shop.nitrokey.com/shop/product/nkhs2-nitrokey-hsm-2-...
1. https://shop.nitrokey.com/shop/product/nkhs2-nitrokey-hsm-2-...