If you have physical access to your own server you could just plug in the USB devices CAs sell you. The cloud HSMs/code signing services are more for people who don't have hardware access and have to rely on someone else's HSM accessed over the network.
