Docs · Guides
Hardware HSM PLANNED
An optional higher-assurance backend. Not what Bengar ships today.
The distinction, kept
SOFTWARE CUSTODY and HARDWARE HSM are different things and Bengar does not blur them. Nothing shipping today is an HSM, and a PKCS#11 software token is a simulator rather than a device.
What a hardware backend would add
- Keys generated on the device, which never existed outside it.
- Non-exportability as a property of the device rather than a policy of the code.
- A device audit log independent of the service's own.
What would not change
The signer contract: four operations, no key export, no import, and no signing of arbitrary bytes. If a device required that contract to change, that would be a finding about the contract rather than a licence to change it.
And there is no fallback. A device that cannot be reached produces a refusal, never a signature made in software instead.