Bigip LTM - Virtual or hardware based?

Perhaps someone from F5 will reply to your question here in DC, but if not, try to contact sales directly to ask for their opinion.

Lately I've been a fan of BigIP VE + External HSM for SSL/TLS performance

I would use the setup above, unless capacity of 4000 series or more is needed outright. My personal opinion is that there's really not much point in going for 2000 series appliance over Virtual these days, unless rare conditions apply (no virtualization readiness etc.).