Cloud
Multi-PKI on a Single CloudHSM Cluster — Why KMS Is the Wrong Tool for Certificate Authorities
AWS KMS can technically sign with asymmetric keys, but it speaks REST — not PKCS#11. For PKI workloads that need HSM-backed signing, key export, and multi-tenant isolation, CloudHSM's Crypto User model gives you partition-equivalent isolation without legacy constraints.