Yeah the HSM idea is good, and it likely helps preventing malicious insiders from hacking user's backups, but I wouldn't trust it as it's not verifiable from the outside.