> Currently, if someone compromises the Cloudfare servers, they gain the bank's private key This is not strictly true, is it? My interpretation is that at best

> Currently, if someone compromises the Cloudfare servers, they gain the bank's private key This is not strictly true, is it? My interpretation is that at best they get temporary access to a server that will sign for them using the key, but the bank can terminate their signing servers at any time and then safely resume using their key without having to revoke it, since it never left their server. This does somewhat increase the attack surface, but it lets the bank keep control over their keys and is better than having their keys get compromised and thus having to revoke them.