Hacker News Reader

Also CAB Forum has started to require private keys in HSM only for code signing certs.

Yes, but you can outsource that part to Digicert et al, so that you don’t need to buy the HSM yourself.