Glossary
Hardware Security Module
A hardware security module is purpose-built hardware for cryptographic key operations — generating keys, signing, decrypting — designed so the key material itself never needs to be exposed outside the device to be used. Software asks the module to perform an operation with a key it holds; the key never has to be extracted into memory somewhere more exposed to do the work.
This matters because a key that only ever exists inside dedicated hardware is far harder to exfiltrate than one that, even briefly, sits in general-purpose memory or storage. The tradeoff is operational: hardware modules are more expensive and less flexible to provision than software-based key storage, which is why they're typically reserved for the keys whose compromise would matter most.