[616c]

Also CAB Forum has started to require private keys in HSM only for code signing certs.

[cpach]

Yes, but you can outsource that part to Digicert et al, so that you don’t need to buy the HSM yourself.