Escrow copy is encrypted, encryption keys held by others (who?). Signing server copy is controlled at physical access level by Access Engineer, so both an Access Engineer and a systems administrator are needed to access the key.