I am not aware of BP key management best practices if there are any would be helpful.
I see these 2 questions:
Is It safe to Store User keys on local db server? Best practice for storing private key in server
But neither really addresses best practices for a block producer storing their key.
I'm also curious if you can just linkauth the eosio:onblock action to minimize the risk if the key is compromised.