HSM

Problem

Your most valuable private key exists as a file. A sufficiently privileged attacker could copy it. You want cryptographic operations without exposing the raw private key to normal application memory.

Solution — Hardware Security Module

Keys are generated/stored inside specialized protected hardware.

Application
    ↓ "sign this"
HSM
    ↓
signature

The private key remains protected inside the device.

Core idea: an HSM protects high-value cryptographic keys by performing operations without exporting the private key.