Some encryption programs store your encryption keys in a file where they can be conveniently accessed. Usually, the keys are themselves strongly encrypted -- this means that you need to enter a pass-phrase to begin using the key file, but you do not then need to enter each key as it is used. This helps ensure that if your key file is stolen, it will be of limited use to the attacker.
Even so, you are advised not to store key files on your hard disk because of the risk of compromise. Store them on a removable floppy disk, if you can. That way there is less to go wrong. Be aware, also, that some key files are stored unencrypted (see PWL), and you are advised to avoid such files at all costs.
Recently, a virus appeared (WM97/Caligula) which can find your PGP secret keyring (if you have PGP installed) and send it via FTP, behind your back, to a virus writers' Web site. The virus styles itself “an exercise in espionage-enabled viruses”, and serves as a reminder that anything that can be done in software can be done in a virus.
from Sophos' V-Files