Lock them in a tamper‑evident vault, encrypt with a key you keep on paper, rotate that key every thirty days, and audit every access log. Don’t let any AI write the key for you.