I don't think rp2040 has any protected storage. HSM is supposed to store keys securely, so even with physical access an attacker would require very advanced methods to extract keys. With typical raspberry pi's, all you need is to connect to the SPI flash and you'll get access to all its contents.

May be I didn't understand something about this project.

Also 124 seconds for RSA2048 sounds awfully slow. Is rp2040 really THAT slow? I feel something's wrong here.

Anyway it's a nice project!