Let's say I have a closed user group and want to send them encrypted data over an insecure channel. I have previously had access to their devices and could have installed a decryption key. Is there any way to make sure that the decryption key can only be used on those devices?
I am not asking how to prevent key leakage in general, as that would be an overly broad question. Rather I am wondering if there is a way to lock down a key to a certain hardware environment?
Bitcoin wallets are a potential example. Some vendors (e. g. Trezor) claim that they can generate keys internally and the keys never leave the device. Does something like that exist for general-purpose encryption/decryption of data?