HSM

A hardware security module keeps keys inside dedicated, certified hardware. Applications send it data to sign; it sends back the signature. The key itself never leaves. Banks and payment networks have used HSMs for decades.

Strengths and limits:

• Strong key protection, often certified to standards such as FIPS 140.
• Rules are limited to what the device supports. Business logic about what to sign usually lives outside it, on a server that tells the HSM what to do.
• Hard to verify from outside: customers usually rely on the certification and the provider's word.

On Valtu

Valtu uses hardware enclaves rather than HSMs. Like an HSM, an enclave keeps keys out of reach of the host and its operators. Unlike most HSM setups, the enclave also runs the signing logic, including checking your team's passkey approvals when team signing is on, and anyone can check which code it runs with remote attestation.