When you set up your client certificates (e.g., using easy-rsa: build-key client-common-name) you are prompted to provide a challenge password. This will require the client to submit a password in addition to their certificate to connect to your openvpn server.
If you already issued client certificates, you can go to the client machines and if they are running windows (openvpn gui) they can right-click on the tray icon, select the configuration and choose "change password". You can add a password to encrypt the key file.
If you are on linux, you can use openssl > openssl rsa -in client.key -out client.key
If I recall this should ask you for a password (to either change or add).
If you have the openssl.exe binary in your program files/openvpn/bin folder you can also do this in windows.
Note that if you do this on your copy of your clients keys you would need to redistribute the encrypted keys to your clients.
A further option is to call a script on the server when a client tries to connect which will can be used to further verify the client. See "Using alternative authentication methods" in the howto
http://openvpn.net/index.php/open-source/documentation/howto.html
