A method for key management in an as-a-service, aaS, context, the method comprising the steps of: (a) upon receiving a creation request in a provider computing-environment, creating a specific key in at least one location in said provider computing-environment by computing respective specific-key contributions (a j): (i) for a set of N computing resources in said provider computing-environment, wherein N is a non-negative integer; and (ii) for a set of M customer locations in a customer computing-environment, wherein M is a non-negative integer, and wherein said customer computing-environment is outside of said provider computing-environment; and (b) applying said respective specific-key contributions to change a specific-key value in said set of N computing resources, wherein said respective specific-key contributions are never revealed in unencrypted form to any computing resource of said set of N computing resources, and to any customer location of said set of M customer locations, other than respective creation-request contributors associated with said respective specific-key contributions during request initiation; wherein said at least one location is a region of memory located in a given computing resource of said set of N computing resources, operationally connected to said provider computing-environment, wherein customer locations are regions of memory located in a given computing resource of said set of M customer locations, operationally connected to said customer computing-environment, wherein said provider computing-environment is a computing environment of an aaS service provider, wherein said customer computing-environment is a computing environment of a customer of said aaS service provider, and wherein said provider computing-environment and said customer computing-environment are configured to exchange data with each other. (a) upon receiving a creation request in a provider computing-environment, creating a specific key in at least one location in said provider computing-environment by computing respective specific-key contributions (a j): (i) for a set of N computing resources in said provider computing-environment, wherein N is a non-negative integer; and (ii) for a set of M customer locations in a customer computing-environment, wherein M is a non-negative integer, and wherein said customer computing-environment is outside of said provider computing-environment; and (i) for a set of N computing resources in said provider computing-environment, wherein N is a non-negative integer; and (ii) for a set of M customer locations in a customer computing-environment, wherein M is a non-negative integer, and wherein said customer computing-environment is outside of said provider computing-environment; and (b) applying said respective specific-key contributions to change a specific-key value in said set of N computing resources, wherein said respective specific-key contributions are never revealed in unencrypted form to any computing resource of said set of N computing resources, and to any customer location of said set of M customer locations, other than respective creation-request contributors associated with said respective specific-key contributions during request initiation;