How to apply encryption on sensitive data exchange?
This is the answer I can come up with after more investigation and comments above:


All boxes have a shared public/private key pair with the private key protected with a passphrase.
The software tool will have the same public key but not the private key.
The software tool also has a symmetrical key. 
There is a server in a secure network that has the shared public/private keys. The server also has the symmetrical key.
When someone with the right to decrypt wants to decrypt a file using the tool they will connect to the secure network via VPN and the tool will send a request for the file to be decrypted. The request is encrypted with the symmetrical key. The server decrypts the request and then the file and re-encrypts just with the symmetrical key.
The symmetrical key can be changed every so often.
Instead of the symmetrical key we could use a second public/private key pair.