Custody mistakes are expensive because they surface late. The YubiKey run let you meet the edges on a desk token; before a CA key goes anywhere near a production appliance, work the manual's full order:
- Mount the module and prove the container can read it — the path in the document is the container path, not the host path.
- Place the PIN as a stored secret, or a tmpfs file owned by uid 65532, mode 0400.
- Apply the document and read the refusal if there is one — the messages name the fix.
- Ask the token what it is with the vendor's own tooling: which token, which slot, which mechanisms. Two tokens rarely agree about mechanisms.
- Decide the custody mode deliberately, and record why.
- Prove non-extractability against the artifact, not the exit code: ask the token to export the private key and check that no file appeared — a tool can exit 0 having written nothing.
- Rehearse the failure you will actually meet: pull the network between keysvc and the appliance mid-signature. From your monitoring, a partition looks like slowness, not absence.
Now I can move a CA onto hardware with the surprises already met.