YubiHSM keeps an audit log of all the data it’s been asked to find. If you find it’s been used to improperly sign a certificate, you can add that specific certificate to your CRL.