For anyone pondering a migration to something on premise, there is also Vault Fork called OpenBao(https://openbao.org/) similar to fork OpenToFu is of terraform.
I haven't tried it out, but it looks they recently added PKCS#11 which should make it possible to use it with devices like HSMs and cloud KMS solutions.
