My application uses an authorization key stored in a protected custom setting to authenticate users to connect to an external web service. Since you can't define a default value on package install for a protected custom setting, I've created a post-installation class that manually sets the custom setting value via code.
The problem is, our security review results suggest that the key should not be stored in code in plain text. How can I go about setting the protected custom setting value if not from code? I'd rather not have the user do this manually.