Escrow a root key and recover or export it with two people.
As pki-admin
Open /keys
Click Escrow
press
Click Recover
Click BYOK export
Open /reports/key-custody