Better to keep them offline and keep ownership of the key as a second factor certainly, but encrypted keys can be a fully acceptable single factor.
Better to keep them offline and keep ownership of the key as a second factor certainly, but encrypted keys can be a fully acceptable single factor.