I suppose the pgp/ssh model of secure device holding the master key plus the ability to backup (eg qr code printout in a safe).

An approximation for phones would be a random key locked in the device with a pin, an the ability to transfer and backup keys as you mention.

Other than that - I've not really heard of gpg keys or ssh keys being brute forced - but that may be because by the point you gain access to the (encrypted) private key - you already have access to everything else?

[ed: for example there are 52 cards in a normal deck of cards, meaning each card encodes about 5.7 bits(2^5=32,2^6=64). You could represent a ~128 bit key as a sequence of ~23 random cards. Or add add a few checksum bits and use half a deck (26 cards).

Note, shuffling a deck isn't a great source of randomness, but you could use dice or a computer to generate the key - then map it to a sequence of cards.]