Yes. You can use HSMs to load the keys; there are various other ways to handle upgrades. It's "non-trivial" in practice.