Usually, at that level, an HSM (Hatdware Security Module (ex: https://www.entrust.com/products/hsm), but also a fair number of processes and procedures around things like private key generation, key attestation, key verification, certificate renewals, etc etc etc).

There are some parallels with a TPM, but also a great deal of divergence (more so than in common, really).

Partially. David Runge held a talk about the Secure Signing enclave at All-Systems-Go.

https://media.ccc.de/v/all-systems-go-2024-263-boring-infras...