Side-channel ignorance: none of the SW solutions are properly zeroing the data. Side-channels can still read them. SW vendors refuse to do that because of performance. Clearing the caches is too expensive.

All the really high end stuff is in financial data centers anyway, surrounded by TV cameras 24/7. Tamper reactance in the HSM itself is cool and everything but the surrounding security handles a lot of what the HSM is made to do.

[dead]