The idea is to run signatory alongside a Google or Amazon KMS as a consensus key. Instead of deploying signatory in a VM, it would be a cloud function activated on-demand when a signature request comes in. This would ensure really minimal costs of operating a cloud HSM.

Due to the limitation of consensus key, most of the logic of signatory needs not be present in the cloud function, in particular the ability to choose which kinds of operations to sign (if it makes sense): only consensus operations ever need to be signed by the consensus key.