The challenges are similar to those involved in signing the root keys for DNSsec (or certificate authorities). Root signing ceremonies make for an interesting read: https://www.cloudflare.com/en-gb/dns/dnssec/root-signing-cer...