This is a somewhat broad question and is really more of an architectural and philosophical problem. Looking for a particular product is often a bad idea on this site, so I will offer some advice.
How do you define "no one else"? Code in the app, other apps on the VM, apps in other VMs, attackers hitting your web site, apps on the VM host, data center administrators, etc.? This will scope the design of the system.
Since we're talking keys, the short and simple design is to move access to and usage of the key out of the realm of those attacking it (helpful answer, right?).
- Hardcoded into the app binaries (anyone with read on the binaries can get the keys)
- Stored in a config file on disk (anyone with read on the config can get the keys)
- Stored in Windows certificate store locally (only local admins can get the keys)
- Stored in a certificate store on another machine with remote services to access (only local admins on the remote machine can get the keys)
- In a hardware-backed security module (HSM) (no one can get the keys)
At each step you introduce boundaries and make it harder to get access to the keys. Those boundaries exist as authenticated services of some sort. Generally you hand the work off to these services and they touch the keys, that way your app doesn't.
The trade off is complexity and manageability for effective level of security.