I should have explained this better: the vault is not to keep the private key safe from home intruders, it’s to keep the key safe from loss and fire and anyone

I should have explained this better: the vault is not to keep the private key safe from home intruders, it’s to keep the key safe from loss and fire and anyone that might compromise my CA machine. It acts as an air gap of sorts. Once in a blue moon when the intermediate cert expires, I pull out the QR code and scan it and convert it to a PEM on a burner laptop, VM, or phone. There I generate a new intermediate and securely delete the root PEM file and put the QR back in the vault. Then I copy the inermediate off the burner machine and go about my business.