Yay for open source hardware security modules

Nitrokeys are less well-known than proprietary alternatives, but they do provide superior security. This is not just about verifying the source code (but that helps), but the more obvious metric is which security issues are present and which can be fixed.
On top of that, the Nitrokey 3C/3A variants have all required HSM functionality to bootstrap your own CA, although their documentation doesn't mention that explicitly. It works, though.

If you didn't buy a security token due to the price normally associated with such tokens, the Nitrokey HSM 2 and the Nitrokey 3C/3A are roughly one tenth of the price of equivalent hardware from Yubikey or others.