can you elaborate on that? Certificates are usually public anyway, but the matching private keys aren't. CAs usually have them on hsm-devices only. if you mean

can you elaborate on that? Certificates are usually public anyway, but the matching private keys aren't. CAs usually have them on hsm-devices only. if you mean private keys are shared via email: keys from the CA-Certs, or just from the Certificates the CA signed? for instance, getting a CA publicly into a browser is expensive and requires audits, so your experience makes me curious