It is expensive --- but here (the Netherlands) you can still fire or demote someone after the initial trial period. Instant dismissal without cause (for non-discriminatory reasons) is possible in the trial period, with trial period being time-limited (1 month for 12 month contract, 2-3 for permanent).
The going rate for firing without cause is about 1/3rd of a month of salary per year of employment for an employee under 55 (?) on a permanent contract. On a yearly contract this is difficult - I would recommend hiring on permanent contracts because they are even seen as a positive.
Demoting will mean that you overpay someone, but will at least clarify the new hierarchy to the team.
What is possible with a HSM depends on the policies of the HSM and key objects (e.g. with PKCS#11). Vendors limit the "most open" policy that you can apply. For example, a FIPS 140-2 level 3 module can not offer unbounded key export (https://security.stackexchange.com/a/83981).
Using a HSM does _not_ guarantee that keys can not be exported. But the converse also holds, a key that is managed by a HSM can not necessarily be exported.
The going rate for firing without cause is about 1/3rd of a month of salary per year of employment for an employee under 55 (?) on a permanent contract. On a yearly contract this is difficult - I would recommend hiring on permanent contracts because they are even seen as a positive.
Demoting will mean that you overpay someone, but will at least clarify the new hierarchy to the team.