E.g. this: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisati...

I am aware of industry talks of lobbying on behalf of HSM manufacturers that led to these requirements and that's just sad.