I'd expect and hope that a Hardware Security Module is in the chain of trust somewhere. For certain cases you just don't want a key to ever be physically accessible except in one heavily-defended location.