Can't speak to my current employer as it's above my pay-grade to know, but at Job-1 we did the following: - All "hot" keys were stored in an offline credential

Can't speak to my current employer as it's above my pay-grade to know, but at Job-1 we did the following: - All "hot" keys were stored in an offline credential manager in specific vaults depending on who needed access to them. Only staff with actual clearance could request temporary access to a vault (fully background checked, 1 year employment, etc). - Copies of each vaulth and our master CA cert were written to 4 encrypted USB sticks. Two stored on-site in the fire-safe and two off-site at our safety deposit box that only c-level staff could access. (We had the same process with our tokens and master logins for AWS). - Any work using those keys was on a pair-up basis, so at least two people, one doing the work and the other observing. - We had a detailed policy around this that covered each step in the process and who needs to approve them; everyone who could feasibly need to access the keys was briefed annually as part of our security awareness training. We handled a LOT of sensitive financial data, so this was the most appropriate way that we could find that maintained both sensible availability and key control. So in order to get to the keys you needed: - Access to the fire safe (Senior Ops, Senior Security and C-Level only). - The LUKS passphrase for the USB sticks (Senior Security and some C-Level only). - The passphrase for the specific vault (Senior Security and some C-Level only). I don't know how the passphrases were managed by our sec team, but I know that the C-Level staff had physical envelopes in their home safes.