As an ex-InfoSec engineer for 12 years, my only concern is they seem to have no process to recover from a defective or destroyed HSM. But other than that it's quite good (though I have only skimmed the blog post.)
We have multiple identical backup HSMs in multiple different sites. Any one of these + a keyholder quorum can recover the system. The entire safe room burning down is part of our possible disasters list.
Great!
Do you perform the same ceremonies for each backup system like described in the post?