Well-designed CAs will create a trust hierarchy, which consists of a root with a number of subroots, to further enhance protection of the private key.