Where to store sensitive keys in a device?
If it can be stored, it can be recovered. 

Consider the unsettling fact that even if you were able to select a hard-to-discover location, since you are using a consumer device, at any point in the supply chain (HDL design, whoever makes your microcontrollers, etc) someone could have compromised the device long before you get to designing the firmware. You are wise to observe the likely-negligible extra security obtained.

As others have mentioned, reactivating JTAG or UART ports is not that big of a deal, and I can just crack open your device and dump out the flash memory anyway. Understanding firmware is easier than ever. You should assume your adversary has access to IDA Pro, understands firmware emulation, and is willing to drop some cash on an EEPROM or flash reader. (This is what I do, anyway.) Being clever may slow an adversary down but it can provide no guarantees.

Even HSMs are not necessarily secure. It's turtles all the way down.