Secretive should do this. It generates a key inside the secure enclave, and you can set it to require TouchID, so you know whenever it's used. Keys can't be exported either.