Have you considered #nsecbunker (or similar) for your key management?
Downside is that the private keys have to be online in order to support on-demand signing requests and grant / revoke logic, right?
1