&gt; Assume the key material isn&#x27;t compromised, since you have to assume that.<p>The nice thing about root certs is the private key is only needed to sign intermediate certs and CRLs. This means they can be kept offline in a secure location, and only accessed once every few months or so to sign new intermediate certs or CRLs. The actual crypto typically happens in a special locked-down piece of hardware, so that the actual private key never touches the memory or disk of the computer being used.<p>The whole process is called a &quot;key ceremony&quot; and follows strict procedures, with technical staff and outside auditors watching every step.<p>As far as I know, no CA has <i>ever</i> had its root key compromised. It would require physically breaking into a secure facility, or factoring of public key. Considering there&#x27;s much lower-hanging fruit for anyone attempting to attack PKI, I&#x27;m not too concerned with a 20 year root cert lifetime. (Like you say, they could just remove it from future versions of OSX before then!)