Which service should be used to meet these requirements?

Explanations:

AWS CloudHSM provides hardware security modules (HSMs) for managing cryptographic keys in a secure and compliant manner, enabling encryption and cryptographic signing operations in a controlled environment.

AWS KMS (Key Management Service) is used for key management and encryption operations but does not provide hardware security modules specifically designed for high-security cryptographic signing.

AWS Certificate Manager (ACM) is used to manage SSL/TLS certificates but does not offer a secure environment for performing cryptographic signing of keys, as it is focused on certificate lifecycle management.

Amazon Connect is a cloud-based contact center service and does not offer any features related to cryptographic key management or secure signing operations.