I would say it's best practice to use a key agent backed by a password manager.