Indeed; what they are doing seems to be pretty much the same thing as any (RSA) hardware crypto device. Except that it's over the Internet instead.