We use a keychain system for that and store the public key in active directory. That allows us to revoke at a per user level all keys. We do a lot of integratio

We use a keychain system for that and store the public key in active directory. That allows us to revoke at a per user level all keys. We do a lot of integration and use 25 different external APIs including s3. BAsically, we don't use global config like that by design - the application only recovers the security context on demand.