The message defining those could be signed on a hardware device though, keeping the master key offline