Wait it literally says this on the page you linked. I'm sorry, what's the question?

I mean it would force people away from very simple passwords (mostly one character repeated) and many long dictionary words are out. But it does somewhat restrict the search space if an attacker knew these were the rules.

@Gilles'SO-stopbeingevil' Sorry, I mean philosophically it likely boils down to the same answer. This is definitely a different question and I did attempt an answer if only for iOS.

It's a rather academic answer. In the real world we assume some things and accept some risk. The OS may have some protections in place, I didn't answer out of deference to anyone who has those details. But, principally, in all HSM formulations we accept anyone with credentials/access to the service can use the key. But it will never be exposed.

This might have the same root answer to a question I answered awhile back: security.stackexchange.com/questions/269155/…

Plus if it's decrypted cloud side, that means somewhere it has to exist in the clear on the server. Probably pretty narrow threat profile handled correctly but it does exist.

CloudHSMs have a max key count per cluster. A two second google said 3300 on AWS. So every user certainly can't have their own key in the HSM (unless this is a really narrow deployment or probably really expensive). So I'll assume you mean a singular HSM controlled key. That would allow anyone with IdP to submit any encrypted key blob and have it decrypted. Maybe there's some controls to make sure that key blob belongs to them but still feels like playing with fire.

To my understanding, depends on the generation. Modern stuff there's a heavy tie in with the security chip on board and unless it's released from MDM/ABM it should persist no matter what.

I spent so much time describing the MDM solution and then read "Without MDM" in the title. The last two paragraphs don't feel like a researched answer although it is about as specific as this forum will probably provide.