I'm still flabergasted the HSM allowed this key to be generated. Then again, I've worked with HSMs, there are always many mistakes in the firmware, usually less severe though.

But eMudhra wanted to (was required to) export the keys.

So using an HSM in the first place is a security theater. Or that this HSM isn't really an HSM since it allows for export of the private key.

The trusted enclave in a MacBook is more secure than this HSM.