The security architect is designing and implementing an internal certification authority to generate digital certificates for all employees. Which of the following is the BEST solution to securely sto

A physically secured storage device (e.g., a safe or locked cabinet) provides physical access control but offers no cryptographic protection against logical attacks, key extraction, or unauthorized copying of the private key data itself.

An encrypted flash drive protects data at rest from physical theft, but once the drive is mounted and decrypted by an authorized user or process, the private key is exposed in memory and vulnerable to logical attacks or malware.

PKI is the overarching framework and infrastructure for managing digital certificates and key pairs; it is not itself a storage mechanism and does not directly address how private keys are securely stored or protected.

A Trusted Platform Module (TPM) is a dedicated hardware security chip designed specifically to generate, store, and protect cryptographic keys in a tamper-resistant environment. Unlike software-based or general-purpose storage solutions, the TPM ensures private keys never leave the secure hardware boundary in plaintext, and cryptographic operations are performed within the chip itself. This makes it the gold standard for protecting CA private keys against extraction and compromise.