If the deployed solutions use an HSM (Hardware Security Module) to protect private keys, restore the device using the tools provided by the HSM vendor.
If you previously ran the clusterctl backup restore command, you do not need to restore HSM-protected keys. The backup file imported by the command includes these keys.