Is there a de facto-slash-industry standard of how to implement it? Any success stories, battle-proven attempts, or big-company shots at it? What are your best practices?
Sensitive information goes into one or more configuration files, possibly in a standard location such as a dotfile in the user's home directory. Each developer has their own set of keys for their own instance, once the software is deployed into production, the software picks up the real keys and goes with it.
In Spring-based projects I've used Spring XML files for the local configuration files (allows dev environments to be radically different from prod) and also used property substitution to read them out of a file that is simple to read and write.
In AWS you can have the platform generate temporary keys that are tied to the machine; the AWS SDK automatically picks them up so you don't need to think about it from a dev perspective. The AWS SDK also has a built in priority mechanism that will let you supply a file to get your keys from so if a dev is working on a machine outside AWS, it gets the keys from the file, otherwise it uses the server roles.
Whatever you do it has to be simple and consistent because the best way to get people to do the right thing is for it to be easier than doing the wrong thing.