If the private key is used in the server for digital signature, once the server is hacked, the private key may be leaked. Is there a way to create a digital signature without exposing the private key?
The solution is to use cryptographic hardware like Hardware Security Module (HSM) or personal device is Cryptographic USB Token or Smartcard. These devices store private key securely on board. Private key never comes out of the device but hash or content to be signed goes in the device and device provides (PKCS11) API to do the cryptographic operations using the key.