How do certification authorities store their private root keys?

security.stackexchange.com