Depends on your level of paranoia. I use an encrypted file on disk to store a client and keys. I back this up offsite incase I get ransomwared. That's good enough for me.
The super paranoid roll dice to generate the private key, use a totally offline computer to convert those dice rolls into an address.
Some self-education links at the bottom as well.