Hardware Security Module (HSM)

Banks, certificate authorities and cloud providers keep their most valuable signing keys in HSMs. When a payment needs to be signed, the application sends the data to the HSM, the HSM signs it internally and returns the signature. A non-extractable key prevents the calling application from simply reading out its secret material. That protection is a configuration choice, not a universal guarantee: AWS CloudHSM, for example, permits owner-authorized export of exportable keys. A compromised application may also misuse its existing signing permissions, even when it cannot extract a key. NIST defines an HSM as a physical computing device that safeguards and manages cryptographic keys and provides cryptographic processing, and its FIPS 140-3 standard sets the security requirements such modules are tested against.

Why it matters for AI agents: if an agent can move money or sign on your behalf, the key that authorizes those actions should not sit in the agent’s memory or a config file where a prompt injection or bug could leak it. Keeping the key in hardware, and only signing after a rule check such as an agent policy engine, limits what a compromised agent can do. A trusted execution environment is a related but different protection that isolates code inside a general-purpose processor.

In episode 65 at 15:12, Ledger CTO Charles Guillemet explains that Ledger uses secure elements in its devices and HSMs on the server side, describing an HSM as “basically like a secure server” in a dedicated data center. At 9:24 he argues an agent should never hold crypto private keys directly; the keys should live in secure hardware that signs only approved transactions. That is his recommendation, from a company that sells secure hardware.