The secret key material and its passphrase are stored on the server that runs our encrypted mailing list software and on systems managed by core Tails developers.
This means people other than Tails developers are in a position to use this secret key. Tails developers trust these people enough to rely on them for running our encrypted mailing list, but still: this key pair is managed in a less safe way than our signing key.
Stored on OpenPGP smartcards owned by those who need them.Smartcards ensure that the cryptographic operations are done on the smartcard itself and that the secret cryptographic material is not directly available to the operating system using it.