HSM-backed key management

Design a multi-tenant key-management service (KMS) with HSM-backed signing for a cloud platform. It must perform 50K sign/encrypt operations per second, never expose key material outside the HSM boundary, support per-tenant key hierarchies with rotation and versioning, and give a cryptographic audit trail of every operation. Threat model: a compromised application host, a malicious operator, and the requirement that no single person can exfiltrate a customer master key. Cover the key hierarchy, how HSMs are pooled for throughput and HA, rotation without breaking old ciphertext, and the trust boundary.