First, you need to ask yourself what you're trying to protect the secret against. Then you can figure out some reasonable mechanism to do it. There's no single

First, you need to ask yourself what you're trying to protect the secret against. Then you can figure out some reasonable mechanism to do it. There's no single proper way. You can't always go with "maximum" protection for everything, because then you'll be doing multiparty ceremonies all the time and it would be mighty impractical https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/