YubiHSM
Yubico's USB-sized hardware security module, an HSM that fits in a USB port rather than a server rack.
Traditional HSMs are rack-mounted appliances priced like a car that need a ceremony just to get started. The YubiHSM 2, launched by Yubico in 2017, sits almost flush in a USB-A port and costs a fraction of that. It generates and stores keys for RSA, elliptic curves and AES, signs and decrypts on request, and never lets the key material out unencrypted.
Software talks to it via PKCS#11, Microsoft's cryptography APIs or Yubico's own library. It is aimed at smaller organisations that want to protect a CA key or code-signing key without buying a data centre, and a FIPS 140-validated variant exists. Performance is modest; if you need thousands of signatures a second, you are the wrong customer.