The above responses are correct. I'd like to add one rather expensive and unlikely option that could enhance security.

The large unnamed bank that I work for uses a hardware encryption device installed in a PCI card on the system. These devices securely hold onto the decrypting key information in protected memory, and provide decryption services via an api. Under no circustances (assuming their engineering is not flawed) do these devices devulge the keys stored in them, they can only be reloaded with different keys. Key loading is generally done offline, on another machine not connected to the net.

While this system actually solves the issues (net attacks) you raised in your post, it can still be defeated by persons that are responsible for loading and handling the keys (inside job).

Cheers

--Fred