Thank you grarpamp, but that's not what I'm trying to prevent/achieve. I simply want to host the private key for a hidden service inside a secure element (a smartcard) to ensure that only the hardware that has direct access to my smartcard can publish the descriptors for the service and decrypt incoming packets. I do realize the host will have complete control over the Tor instance and that's fine, I simply want to prevent it (or a different host) from ever publishing this HS without having access to the smartcard.
The idea is to tie the HS to the physical smart card - whoever holds the smartcard can publish the service, once the card is removed, the service moves with it.
An attacker (with or without physical access to the machine running Tor) would not be able to extract any information that would allow him to impersonate the service at a later time. Of course, he can change the _current_ content or serve his own, but cannot permanently compromise the service by reading its private key.
Thank you,
Razvan
--
Razvan Dragomirescu
Chief Technology Officer
Cayenne Graphics SRL