You can encrypt the keys in that service, and then use an authenticated service agent to decrypt it.