You can use something like vault, they have "crypto as a service" https://www.vaultproject.io/docs/secrets/transit/index.html

You still have to bootstrap vault, but it's a pretty robust and easy to implement HA system.