Certificate Authority generates private key for Extended Validation code signing certificate?

Question

My company upgraded to an Extended Validation code signing security certificate, which was delivered via mail on a physical USB key, called a "token." The token contains a private key and the digital certificate, both generated by the Certificate Authority (CA). I was surprised that the CA created the private key. It is my understanding that private keys should never be shared with a third party, including a CA. I'm used to the Certificate Signing Request (CSR) process, where a company keeps its private key private and only shares its public key.

My question: What security concerns are there with a private key being generated and initially owned by (in possession of) a Certificate Authority? Is this standard practice for EV certificates delivered on a physical token? We are told that the private key only exists on the token and there are no other copies.

Perhaps I'm missing the point. Maybe it's more about establishing trust with a CA, and therefore we should also trust that the private key was handled correctly and that we have the only copy (E.g., why do business with them if we don't trust them). At the same time, alerts go off because a third party had our private key. I realize that it might not be practical to create a token unless the private key is present, so maybe it's inevitable that the CA possesses it at some point.

Answer 1

It is common for code signing certificates to be hardware backed, since in the past there was lots of misuse by stolen code signing certificates. Hardware backing a certificate means that the actual hardware needs to be present when signing. The signing itself happens on the hardware itself, i.e. the private key never leaves the hardware. The hardware is designed so that it should be kind of impossible to extract the private key from the hardware.

For this use case the private key usually is created also directly on the hardware, i.e. not created outside and then stored on the hardware. This means that the CA does not have access to the private key either. But yes, one needs to trust the CA to actually implement it this way.