They use special signing software (dirk or web3signer) that can have the keys split accross several physical machines. If they have separate access credentials for each system, it makes it difficult for anyone to have access to the complete keys. Then a central validator client can request signatures from each signer to complete attestations and block proposals.

This didn't really answer my question though. There's other software besides key management services that run on those nodes. How is that being managed if these orgs are not doing some form of Devops?