"HSM-backed" is a phrase that hides the difference — the manual's words, not ours. goca replaces it with one question: where is the private key at the moment a signature happens? Three answers exist: software (in process memory, unwrapped under a key derived from the master secret), pkcs11-wrapped (also in memory — but only the HSM can put it there), and strict pkcs11 (never leaves the token; every signature is one C_Sign). The ranking is stated flatly: pkcs11 > pkcs11-wrapped ≈ software.
Choosing wrapped for throughput requires a recorded, audited acceptance of the trade — with a reason a reviewer reads. The strict modes need no paperwork, deliberately: making the safe mode the one with paperwork is how operators end up in the fast one.
The whole story — acceptance gate, vendor presets, real hardware — is Key Custody & HSM Connection.