The question that should decide your CA engine: if the internet-facing part is compromised, can the attacker mint a certificate? In goca the answer is structural — no externally reachable component can mint one alone.
Every enrollment through the public issuance API is split across services with different authority. The API only records requests. The RA authorizes — but holds no signing key and no key-unwrapping secret. The issuer builds and lints the exact certificate bytes — but cannot forge the RA's signed decision. The key service signs — but only for authenticated callers, against a recorded, purpose-bound intent for exactly those bytes. The manual states it as a compromise matrix: for each captured component, what the attacker gains, and what still blocks issuance.
The full walk through the pipeline — request, decision, intent, signature — is in What You're Running — right after you've stood the system up yourself.