I did further analysis / reverse engineering of the Utimaco SecurityServer HSM simulator today (several firmware versions, including FIPS mode enabled). I could verify the workflow #eMhudra described on Bugzilla end to end. The software isn't checking the private keys during import (just OID-based bit-strength check). But FIPS 140 does not mandate this. So it's basically an "operator oopsie".

If someone has access to Utimaco HW or has firmware to share for the HW-based HSM, I'll dig into it.