I've been building a product using AWS CloudHSM and things are working well in the POC.
Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to have it sign messages with private keys it holds.
The problem this manifests is there seems to always be a need to keep a private key in software.
For e.g. my signing manager I have to keep the private key in a software based keystore!
Does this not erode the value of using a HSM in the first place? What is best practice?