TEE

Key is stored in Trusted Execution Environment. Hardware-backed security, widely available.