> All physical and logical security controls remained intact.

Did the HSM have a fault, or was the key generation script at fault?

I suspect the later given the choice to exit the business. If they had strong evidence that a FIPS-compliant HSM misbehaved, I suspect they'd be more willing to fight this.