FIPS 140-3
FIPS 140-3 is the US standard for validating cryptographic modules. The CA keys of PKI-as-a-Service are generated and held in FIPS 140-3 Level 3 HSMs, hardware devices in the EC datacenter, so the keys are protected by tamper-resistant hardware and are never exposed to software on the CA server.