Where are your rotation and signing keys stored? Who can access them? Talking here about the majority case.