Back from the token? Your YubiKey could not offer this mode at all — nothing to wrap under — so this is the one custody you have now read about but not held. What does pkcs11-wrapped actually expose? The wrapped blob is handed to the token, which unwraps it under a key only the token holds and returns the private key. From that moment your CA private key is plaintext in the key service's address space for the duration of the signing call — exposed to everything process memory is exposed to: a core dump, a debugger, /proc/<pid>/mem, a swapped page, any read primitive an attacker finds. The garbage collector may have copied it.
What it buys in exchange is real. The key was generated by the HSM's RNG inside the HSM and has never existed anywhere else; the wrapping key is not in the database, not in the environment, and not extractable — so a stolen database is inert. And signatures happen at CPU speed rather than one appliance round trip each: for a CRL over a million revoked certificates, that is the difference between minutes and seconds.
That is the whole trade — throughput for a weaker where-is-the-key claim. A high-volume issuing CA behind an appliance rated for a few hundred signatures a second is where wrapped earns it. Nothing else is.
Now I can defend — or refuse — the wrapped trade with specifics.