ok, then how do users authenticate to those modules? what happens when they lose their authentication credentials?

or do you mean HSMs in the possession of the user? what happens when they lose it, or the device is stolen?