Keys that stay in the building
Orbit Mail asked where the private keys live. The answer is a room, a cabinet, and a log.
Orbit Mail asked a fair question: where do the private keys live. The answer is not a vendor slide. It is a room on the second floor, a cabinet with two locks, and a paper log that Otto still checks.
Hardware tokens leave the cabinet in pairs. The second person is not a ceremony. It is how we sleep.
Cloud KMS holds the working keys. The root stays in the building. If that sounds old-fashioned, good. Old-fashioned is a security strategy.