I used to put CA keys, encrypted, in a repo only ops admins have access to. The passphrase was shared manually with each admin, once. If/when an admin left, the

I used to put CA keys, encrypted, in a repo only ops admins have access to. The passphrase was shared manually with each admin, once. If/when an admin left, the plan was to rotate the CAs. All SSH and TLS servers I used this for had the ability to use multiple CAs, so the rotation itself worked.