Secure CA private key storage

Is there currently any way to securely store the CA private key, while still using the cfssl CLI, specifically cfssl serve or multirootca?

Apparently PKCS#11 support in the CLI was removed in #519. Now, in order to use PKCS#11 with cfssl, I suppose one would have to use https://github.com/letsencrypt/pkcs11key and develop something like cfssl/cli/serve with pkcs11 options?

There are mentions of experimental Red October support in multirootca. I am not sure of its current status, but I believe it is not currently working. In [multiroot/config](https://github.com/cloudflare/cfssl/blob/master/multiroot/config/config.go#L202), the `priv` variable is not set.

Are there other alternatives? Have I missed something?

Thanks for all the hard work!