Frankly, if a copy of the private keys leaves a controlled server, the entire system should be considered compromised and torn down and re-done, which might be

Frankly, if a copy of the private keys leaves a controlled server, the entire system should be considered compromised and torn down and re-done, which might be the entire point of this....