Everything regarding encryption keys, certificates, passwords, etc is really only as effective as how quickly you can replace them. Sure a HSM is really secure and powerful, but if it will take you a year to replace everything it generated after a breach, it's not an effective solution IMO. Build and implement this stuff with change and iteration in mind.
