Help - How does CAcert protect its root private key?