In the case of DNSSEC, the ultimate 'root key' is handled quite carefully and is interesting to read up on.

https://www.iana.org/dnssec/files

https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/