If you're interested in how you might isolate the private key in a separate process, as proposed by this article, I sketched out an implementation a year ago: h

If you're interested in how you might isolate the private key in a separate process, as proposed by this article, I sketched out an implementation a year ago: https://www.agwa.name/blog/post/protecting_the_openssl_private_key_in_a_separate_process https://www.agwa.name/blog/post/protecting_the_openssl_priva... I hope to update it soon to support ECDSA keys in addition to RSA. (This wasn't previously possible, but I think it's now possible with OpenSSL 1.0.2.)