requires that you encrypt stored credit card information -- for example, if you're an online merchant like Amazon that allows repeat customers to order without re-entering their credit card number. But it doesn't seem to have any requirements about how you store the decryption key, only that you document what you're doing: "Document and implement procedures to protect any keys used for encryption of cardholder data from disclosure and misuse" and "Fully document and implement key management processes and procedures for cryptographic keys used for encryption of cardholder data". Does that mean that if you store the decryption key right there on the same disk as the encrypted credit cards (with some restrictive file permissions, at least), that's OK, as long as you document that's what you're doing?
If your answer is "No, you need to do XYZ", can you clarify whether (a) you are referring to some requirement laid out in the PCI DSS that I missed; or (b) you're talking about a requirement that's not laid out in the PCI DSS, but it's an unwritten rule that the PCI Security Standards Council holds people to anyway.
(If I were trying to do it securely, I'd have the decryption logic carried out on machine A, the decryption key stored on machine B where it can only be retrieved by machine A, and the encrypted card numbers stored on machine C where they can also only be retrieved by machine A. Since the key and the card number have to be stored somewhere, I don't think you can do better than this, unless you start splitting the encrypted card number across multiple machines so that the attacker has to read each one in order to piece it back together. But I'm not asking what is most secure, I'm just asking what the letter of PCI DSS requires.)