The hardware security module does not need to change to support tying to a credentials. I showed how to do this years ago and the theory was known long before. Its just that the EU is making self imposed barriers to doing this right.