Yeah but surely there’s a happy medium ground between HSM and storing it on some old mates desktop (which would have to be what’s going on here).

It still shouldn’t have been easily accessible to anyone except the instances running the SSH service.