public static IDataProtectionBuilder AddCaDataProtection(this IServiceCollection services)
{
    const string applicationName = "CertificationAuthority";
    var registryKey = Registry.CurrentUser.CreateSubKey($@"SOFTWARE{applicationName}keys");
    return services
        .AddDataProtection()
        .SetApplicationName(applicationName)
        .ProtectKeysWithDpapi()
        .PersistKeysToRegistry(registryKey);
}