An option that's not in the list: check you CA key into source control (but with a very strong password). If you set the number of rounds large enough and have

An option that's not in the list: check you CA key into source control (but with a very strong password). If you set the number of rounds large enough and have an excellent password this is sufficient (not as good as HSM, but probably safer than Vault). The real thing that gets me though, is how to deal with different users needing access to different subsets of machines. That's where I miss Kerberos.