>I'm fairly familiar with the BR's, having spent more time reading through (portions of) them than I'd have preferred -- and I keep a hard copy here in one of m

>I'm fairly familiar with the BR's, having spent more time reading through (portions of) them than I'd have preferred -- and I keep a hard copy here in one of my desk drawers -- I'll happily admit that don't know the answers off the top of my head. CAs are required to have a statement on practices for deactivation and destruction of private keys per the BRs; it's 6.2.9 and 6.2.10 respectively. e.g. for Let's Encrypt: https://letsencrypt.org/documents/isrg-cps-v2.6/#6-2-9-method-of-deactivating-private-key https://letsencrypt.org/documents/isrg-cps-v2.6/#6-2-9-metho...