HSMs, always about secure key storage for me, for the most part, it's been either Thales NCipher or Gemalto SafeNet. One contender you could consider is Utimaco, I came across them at a stand last year and Sophos had spun them out. They would need to operate a very tight ship being German. Of course, all HSM providers have some sort of management solution.
Another solution for storage might be on smart cards - as required for 'Qualified Digital Signatures'*.
Specifically, with regards to software, Venafi is the key management beast and covers everything if you have a broad use case I've not seen anyone beat them.
Though a lot depends on what kinds of keys and where Digicert(spun out of Symantec) has a managed PKI that works for certificates, Tectia can do SSH, Cyberark can do some of these plus privileged user management and secret injection into containers.
OP, What sort of 'keys' are we talking about here?
*These are really a thing, big in Europe and, nope sadly are not hashes encrypted with private keys that studied at university... 😛
