Protect private keys for an issuing certificate authority