We are working on a Cloud-HSM integration for the sc-hsm-pkcs11 module. That way you can define an URL to which the PKCS#11 module will connect in the C_Login call. In the web-service at the other end you can perform public key authentication and enabled access to the device. When you disconnect the token from the web-service, the PKCS#11 processing will continue.
We will post here, when that function is available.