A method comprising: receiving, by a hardware security module, a request to take an action in a cryptoasset custodial system for an account holder registered with the cryptoasset custodial system; authenticating, by the hardware security module, a policy map associated with the action, wherein the policy map defines access control rules governing which actions are allowed under one or more specified conditions including a threshold number of endorsements needed to approve the action; validating, by the hardware security module, at least two endorsement messages out of two or more received endorsement messages for the action by checking digital signatures of the two or more received endorsement messages, wherein at least one of the validated endorsement messages has been generated by digital signing with a private key of a person, who is associated with the account holder, responsive to input from the person using a computing device that securely stores the private key of the person, and at least one of the validated endorsement messages has been generated by digital signing with a private key of a program, which is associated with the account holder, responsive to the program confirming one or more circumstances specified by the account holder are met; confirming, by the hardware security module, that the validated endorsement messages satisfy the threshold number of endorsements needed to approve the action in accordance with the authenticated policy map; using, by the hardware security module, a private key associated with the action in a process of digitally signing data to authorize the action; and sending, by the hardware security module, the digitally signed data to another computer to effect the action. receiving, by a hardware security module, a request to take an action in a cryptoasset custodial system for an account holder registered with the cryptoasset custodial system; authenticating, by the hardware security module, a policy map associated with the action, wherein the policy map defines access control rules governing which actions are allowed under one or more specified conditions including a threshold number of endorsements needed to approve the action; validating, by the hardware security module, at least two endorsement messages out of two or more received endorsement messages for the action by checking digital signatures of the two or more received endorsement messages, wherein at least one of the validated endorsement messages has been generated by digital signing with a private key of a person, who is associated with the account holder, responsive to input from the person using a computing device that securely stores the private key of the person, and at least one of the validated endorsement messages has been generated by digital signing with a private key of a program, which is associated with the account holder, responsive to the program confirming one or more circumstances specified by the account holder are met; at least one of the validated endorsement messages has been generated by digital signing with a private key of a person, who is associated with the account holder, responsive to input from the person using a computing device that securely stores the private key of the person, and at least one of the validated endorsement messages has been generated by digital signing with a private key of a program, which is associated with the account holder, responsive to the program confirming one or more circumstances specified by the account holder are met; confirming, by the hardware security module, that the validated endorsement messages satisfy the threshold number of endorsements needed to approve the action in accordance with the authenticated policy map; using, by the hardware security module, a private key associated with the action in a process of digitally signing data to authorize the action; and sending, by the hardware security module, the digitally signed data to another computer to effect the action.