We are using a private key for encryption. At the time of installation, we are generating a random key using Salesforce Crypto class and storing that key in a custom setting.
Admins will be able to view the encryption key in a custom setting. Need a suggestion that should we keep a private key in custom settings or should we keep it as Hard Coded in class?
By keeping as Hard Coded key in Apex, any users will not be able to read private key in managed package class. Can someone suggest their thought on storing private keys in Custom Settings vs Apex Class constants?