It is insane that this key is not kept in a HSM.

It would be good if there way a way to attest that a key was generated on and bound to a specific HSM.