I configure ssl_engine in nginx as pkcs11. It means that nginx server used the key stored in hsm as its identity in TLS connection. However, the TLS master key (or shared key, or session key) is depend on what comes from client, cannot be generated in hsm itself.
So are those key : the TLS master key (and shared key, and session key) stored in nginx memory instead of HSM? if yes, the incoming TLS traffic to nginx are not decrypted in HSM, are they?

Here is the file /etc/nginx/nginx.conf

user  nginx;
worker_processes  1;
error_log  /var/log/nginx/error.log debug;
pid        /var/run/nginx.pid;
events {
    worker_connections  1024;
}
ssl_engine pkcs11;
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    server {
        listen 80;
        listen 443 ssl;
        ssl_protocols    TLSv1.2 TLSv1.3;
        server_name www.SEexample.com SEexample.com;
        ssl_certificate /etc/ssl/certs/seexample.com.crt;
        ssl_certificate_key "engine:pkcs11:pkcs11:model=SoftHSM%20v2;token=mytoken2;object=sekey;type=private?pin=1234";
        root /var/www/html;
        index index.html;
        ssl_trusted_certificate /etc/ssl/certs/SEcombine2.crt;
    }

    access_log  /var/log/nginx/access.log  main;
    include /etc/nginx/conf.d/*.conf;
}

How can TLS traffic be forced to decrypt inside an HSM?

Thank you!