You want to investigate a Hardware Security Module. This offloads the keys (and the crypto processing) to a hardened device from which the keys cannot be extracted.
The best known ones are from Thales and Safenet, and they offer versions that are local PCI boards, locally attached (via USB) and network-attached.
If you only have one or two keys, you can also use a USB token, which is a small, low-end HSM in a form-factor similar to a thumb-drive. Another alternative is a smart-card or CAC, which is the chip from a token in a PVC card that is the same size as a drivers license or passport card, or like a very chubby credit card.
In any of these cases, you would install a driver and engine (both are software constructs) to access the device. From here, you would not have access to the key, and would instead access it via the PKCS#11 API interface or the Windows CryptoAPI, which would wrap the request to have the encryption/decryption on your behalf in hardware.
I would also recommend to have three of these devices, of the same type. When you gen and import the keys, do it on all of them, and then test-encrypt the same string with each and compare the output. If it does not match, beware. The first one is for online use. The second is for near-line backup (if it were pocket-sized, in your safe or in your secretary's locking filecabinet) . The last one is your DR/BC copy, and that should stay with your lawyer, with written instructions about when and to whom it can be released. Put simply, over a long enough time, these devices can fail, but are statistically unlikely to all fail together.