On what device is the eSign private key stored? Does it meet FIPS 140-2 Level 2 (a mandatory requirement of the CA/B Forum for EV certificates) or Level 3?

The private key is stored on a Thales Luna K7 device, which meets the FIPS 140-3 standard, exceeding the mandatory requirements of the CA/B Forum.