Where Your Internal CA and Code-Signing Keys Should Live

Where is your internal root CA key right now? In many infrastructure reviews nobody can answer that precisely. In one of them, the root key sat as a .pfx file on a VM backup share, and the code-signin