Your solution, in order to be comprehensive, must be a combination of procedural and technical controls. The best way to understand it is to see technological controls as providing the capability to enhance your procedural security. They make some controls possible, and others easier to execute.
With this in mind, it will largely depend on how you're using your PKI. If you're in a smaller organization, budget constraints may limit what you can do, but if possible, I'd recommend a Hardware Security Module (HSM) to protect your private keys--at the very least, the private keys of your internal CA, if you have one. Vendors in this space include Thales and SafeNet.
As for passwords, there are a number of password management solutions designed to service organizations. The most important thing to look for is either one of two things: A solution which offers the ability to entitle a user with the access privileges necessary to do their job within a pre-defined time window without having to give said user the actual password to the system/application, AND/OR a system designed to support split-secret knowledge (where no one individual has the complete password).
Some security vendors offer a means to create additional role separation in what an AD Domain Admin or DB admin can do (for example, they may be able to add users to groups, but not enable the ability to actually open/modify files that membership of that group normally entitles them to--that ability would be handled by yet another admin who likewise cannot add/remove users to groups). One such vendor is Vormetric--they do this with their data at rest encryption product.
While executive support is important to the success of any organization's security strategy, it becomes especially vital in the absence of a vendor solution which provides these capabilities--because that means you'll likely need to step up your security awareness programs to foster the kind of culture change that will support the necessary procedural controls most IT users aren't used to--where domain and enterprise admin privileges are strictly controlled, and entitled only after change management approval is granted, and only during a specific time window. IT admins must incorporate multi-person password + Physical controls.
Examples include using 2-4 people to generate halves of a 12-character password. One pair of personnel generates the password and enters it into the "New Password" field. The second pair re-enters the password components that the first pair created (to help ensure one of the first pair is not maliciously or unintentionally mis-typing the password each time, rendering the account inaccessible once the password is changed). Using a second pair of personnel also ensures that the passwords are legible as-written. Once the password is changed, the password fragments are then stored in separate opaque envelopes, sealed, labeled, and deposited in tamper-evident bags. Bags can then be dropped in a physical safe. Replicate the process for off-site backup storage, but incorporate processes to ensure password updates are replicated each time for each site. If tamper-evident storage is not enough, look for a GSA-approved double-combination safe (X-10 Kaba Mas, for exmaple), and incorporate the same split-knowledge procedure. For additional protection, store the safe in a location with a CCTV camera system monitoring the area, and incorporate a warning to all employees that anyone found in the area without prior written permission to enter may be subject to termination--again, this should come from the top.
It really just depends on your threat model and what appetite your organization has for security.