Applications talk to an HSM through PKCS #11, KMIP, Java JCA providers, Windows CNG or vendor and cloud APIs; the key never leaves, only signatures or decrypted data do. Assurance is usually stated as FIPS 140-3 (or 140-2) validation level 2 or 3, or Common Criteria. Publicly trusted CAs must keep their keys in such devices, and since 2023 publicly trusted code-signing keys must also be generated and stored in hardware.
Cloud key management services (AWS KMS, Google Cloud KMS, Azure Key Vault Managed HSM) expose HSM-backed keys as API resources with IAM policies and audit logs. Their ECDSA sign calls return DER-encoded signatures, which must be converted to raw r‖s for JWS ES256 tokens, a common integration bug.
Limits to check before choosing one: supported algorithms and curves (Ed25519, secp256k1 and post-quantum algorithms vary by model and firmware), throughput and latency per signature, key backup and cloning procedures, and whether pre-hash signing is required for large messages.