I can confirm we use the secure execution environment of the HSM, we say VMs in a general sense because of the limited knowledge of HSMs, makes it easier for people to understand. But it is actually compiled C code running in the tamper proof / tamper resistant part of the module doing the share issuance and the multiparty computation protocols.