Comment by Inflatablewoman

If you have one backed by a HSM (Hardware Security Module) then you could be in a good spot. Similar set up to what AWS KMS does.

https://aws.amazon.com/kms/details/