Connecting an HSM is not a config file on a host — it is a Pkcs11Module document: named, versioned, append-only, audited, applied through the same API as every other setting. There is no supported path that writes it into the database directly, because the apply path is where validation runs and where the audit entry comes from.
Two fields carry most of the weight. library is the absolute path of the vendor's PKCS#11 module inside the keysvc container — goca ships no vendor library, ever; you mount it read-only, alongside the vendor's own config file. And tokenLabel is the authoritative selector: slot IDs are assigned at initialization and legitimately change after a reboot, a re-insert, or a client-library upgrade — a production module selected by slot index will one day sign with the wrong token or none. tokenSerial never searches; it pins, catching the right label on the wrong appliance.
The field set is closed — an unknown field is refused at any depth. That is the load-bearing half of "no credentials in a config document": there is no free-form corner for a PIN to sit in.
Now I can describe my HSM to goca in one audited document.