A PKCS#11 key can be protected and still be over-authorized Moving a signing key into an HSM changes where the key material lives. It does not automatically decide which application, workload, or operator may use that key for a particular purpose. PKCS#11 provides object attributes and authenti...
Source: [Dev.to](https://dev.to/ioneyrezende/a-pkcs11-key-can-be-protected-and-still-be-over-authorized-2pkb)