Import private key in HSM Luna SA

Question

I need some clarification on how keys are imported into a HSM Luna SA. I should import BIP 32 private keys of multisign wallets. There are currently two keys: one for the user and one held by the company that would like to start using HSMs.

I start with a general question: is it better to keep all the individual private keys in the hsm or a single master key that is used to encrypt the private keys of the wallets?

How are BIP32 keys imported into an HSM? Is the serialized format used? Are there any other keys that are needed for the import (wrap for example)?

I accept other advice on implementing the BIP32 with the Luna.

Answer 1

This is what is reported in the thales documentation:

Private Key Import/Export Private keys can be imported and exported with existing PKCS#11 functions. 
They can be imported and exported only if the HSM uses the key wrap model instead of cloning.
Import a key by calling C_Encrypt*() on the serialized key followed by C_UnwrapKey(). Exporting keys by calling C_WrapKey() followed by C_Decrypt*().
Use C_WrapKey() and C_UnwrapKey() to store keys off the HSM, or to move them between HSMs.

I don't know the use of PKCS11;

which key is used for the wrap?