> how you protect the signing certificates

You get an HSM like this: https://www.veritech.net/product-detail/keyper-hsm/ that stays air-gapped.

Then you build procedures around it, like https://www.iana.org/dnssec

Not cheap or easy.