Secure identities with HSM

Problem

Currently, if a device connected to a Zerotier network is compromised, an attacker will gain access to the entire network and all nodes connected to it will be at risk.

Since identity secrets are stored as a file on disk, they are volunerable to remote theft which increases the likelyhood of an attack.

As ZeroTier gains in popularity and use, theft of identity secrets might become popular and frequent. Given the major downside of loosing these files, it seems appropriate to consider remedies.

Possible solution

By using an HSM (Hardware Secure Module) such as a Yubikey or similar, we can remove the possibility of remote attacks and reduce this risk to the lower probability local theft scenario.

Is it possible and/or feasible to keep zerotier identities on an HSM and only enable ZeroTier networking if the HSM is connected?

Having a ZeroTier identity tied to an HSM will also make the identity conveniently portable wherever you take your HSM.