It's possible to sign transactions offline, so that the private key never touches a device that's connected to the internet. Check out http://www.bitcointrezor.com/