> If you've got one key, it has to be transferred to each HSM module, which means it's going to be in their deploy code

There's products out there that allow for keys to be securely shared amongst multiple HSMs, without the key ever existing in clear text outside the HSM.