Q:

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication.  I'm using the TOTP protocol as described in RFC 6238.  In our scheme, we are storing, in addition to a b-crypted password hash for each user, a secret key, which is used to validate one-time codes.  
I'm using postgreSQL for a database backend.  Let's pretend my database is compromised without my knowledge.  The passwords are all safe since I'm salting and bcrypting them: there is no easy attack that will reveal all of the passwords, short of brute forcing each one.
Is there any way I can safely store the key for the TOTP though?  I can't hash it, I need its plaintext for OTP validation.
Is there any way to securely store this key?

A:

Yes. Encrypt the plain-text TOTP key on the application side and save the cipher-text into the database. If you cannot trust the application either, use a HSM (hardware security module) or create and use a software version of it.

