Backups Differ by Mode — Operator training

"The HSM backs up our keys" is a sentence that is wrong in both custody modes — in opposite directions. Generating a pkcs11-wrapped key wraps it out of the token and then destroys the token's copy: the wrapped blob in your database is the only copy of that CA key that exists anywhere. Lose the database and the CA is gone; the HSM cannot give it back. Strict pkcs11 is the reverse: the token holds the only copy, your database holds none, and your backup problem becomes the appliance's own — vendor replication, cloning ceremonies, whatever your device supports.

Neither mode is "backed up by the HSM". They just fail in opposite directions, and your backup plan has to name which direction each CA fails in.

Metaphor: wrapped custody keeps the only key to the vault in your filing cabinet; strict custody welds it inside the vault. Losing the cabinet or losing the vault are different disasters — but each mode has exactly one.

Where it breaks: a filing cabinet is one theft from useful; the wrapped blob is inert without the token — theft is covered, only loss is not.

Now I can say, per CA, which single copy of the key must survive.