youtu.be/b9j-sfP9GUU
a key signing ceremony is by far THE most physically secure way to generate and store a long random string
the above is for dnssec, similar is done by ca authorities like emudhra but its never public. if a similar incident happened to say LetsEncrypt, i kid you not, half the internet would be offline for atleast few days
