Explanation
Creating a protected custom metadata type that stores the encryption key and packaging it with its associated records in a managed package is the best way to securely store the confidential key, as protected custom metadata types are only accessible within the package namespace and cannot be viewed or modified by subscribers2. Creating a protected custom metadata type and packaging it in an unlocked package will not work, as unlocked packages do not support protected custom metadata types3. Creating a custom metadata type and restricting access to the admin profile will not work, as users with View Setup permission can still view the custom metadata type and its records.