Correction: It was pointed out elsewhere that you can just tell sshd to use PKCS11 keys via the SSH agent mechanism, and so yes that would allow use of an HSM for host keys