Give your agent a handle to a signing capability, never the key itself.

The hardware keystore paper drove key-exfiltration success from 19.3% to 0% across four models and 12 injection scenarios by putting a hardware execution boundary at the end of a five-layer chain that returns only opaque result handles. You don't need an HSM to apply the principle: any indirection where the agent invokes a capability it cannot read gets you most of the way there.