Are realm encryption keys stored in the DB? If so, what do we need to do to protect them?

Hi, Could you please help me understand how to protect the realm encryption keys? I have been searching the documentation and online Q&A, and I have not been able to work out if the realm encryption keys are actually stored in the database (mysql in my case), and if so where. I looked at my database and I could not find anything that looked like them.
If they are not in the database, where are they? In a keystore on the keycloak machine/container?
I am trying to work out what I need to do to protect the encryption keys. I saw some posts about requesting a feature to store them in a vault, but as based as I can tell this is not available yet.
Thanks a lot for your help,