We have multiple identical backup HSMs in multiple different sites. Any one of these + a keyholder quorum can recover the system. The entire safe room burning down is part of our possible disasters list.