It's best to not have private keys online at all.
If you use a wallet like Armory, https://bitcoinarmory.com/, you can create your wallets offline (an old laptop with wifi disabled is a good choice).
Then create a watching only wallet (no private keys) that you have on a different machine with ...