They become a very high value target though and I have learned "security software" devs are as fallible as all devs, sometimes more.

Thycotic had some vulnerability with a symmetric recovery key a few years ago. But comprehensive product like this or roll your own this is frequent so I'd rather do keys and certs like others suppose