You speak as if we need a separate key for each service. If private piece of the recovery record is in the trusted store and zabekapit - just one or two, in production and test environment, for example.
In General, KeePass, as has been mentioned above.