Who holds the key?

TL;DR: split hot and admin keys, put the admin role behind a multisig or KMS, write the rotation...