Usually, at that level, an HSM (Hatdware Security Module (ex: https://www.entrust.com/products/hsm https://www.entrust.com/products/hsm), but also a fair number

Usually, at that level, an HSM (Hatdware Security Module (ex: https://www.entrust.com/products/hsm https://www.entrust.com/products/hsm), but also a fair number of processes and procedures around things like private key generation, key attestation, key verification, certificate renewals, etc etc etc). There are some parallels with a TPM, but also a great deal of divergence (more so than in common, really).