A computer system comprising: a central processing unit; a memory coupled to the CPU; and one or more computer readable storage media coupled to the CPU, the one or more computer readable storage media collectively containing instructions that are executed by the CPU via the memory to implement a method of distributing a root key to a hardware security module of an HSM cluster, the method comprising: the computer system transmitting a first command to a source HSM to create a master key, the first command being signed by an administrator of HSMs in the HSM cluster; the computer system receiving, from the source HSM, a fingerprint of the master key in a response signed by the source HSM using a module signing key hardcoded into the source HSM at a manufacturing time of the source HSM; the computer system transmitting a second command to a first HSM in the HSM cluster, the second command generating an importer key pair comprising an importer private key and an importer public key; in response to the transmitting the second command, the computer system receiving the importer public key from the first HSM; the computer system transmitting to the source HSM a request to export the master key and the importer public key; in response to the transmitting the request, the computer system receiving from the source HSM (i) the master key wrapped with a transport key and (ii) an exporter public key, the transport key derived from the importer public key and an exporter private key; the computer system transmitting, to the first HSM, (i) the master key wrapped with the transport key and (ii) the exporter public key; and the computer system activating the master key in the first HSM. a central processing unit; a memory coupled to the CPU; and one or more computer readable storage media coupled to the CPU, the one or more computer readable storage media collectively containing instructions that are executed by the CPU via the memory to implement a method of distributing a root key to a hardware security module of an HSM cluster, the method comprising: the computer system transmitting a first command to a source HSM to create a master key, the first command being signed by an administrator of HSMs in the HSM cluster; the computer system receiving, from the source HSM, a fingerprint of the master key in a response signed by the source HSM using a module signing key hardcoded into the source HSM at a manufacturing time of the source HSM; the computer system transmitting a second command to a first HSM in the HSM cluster, the second command generating an importer key pair comprising an importer private key and an importer public key; in response to the transmitting the second command, the computer system receiving the importer public key from the first HSM; the computer system transmitting to the source HSM a request to export the master key and the importer public key; in response to the transmitting the request, the computer system receiving from the source HSM (i) the master key wrapped with a transport key and (ii) an exporter public key, the transport key derived from the importer public key and an exporter private key; the computer system transmitting, to the first HSM, (i) the master key wrapped with the transport key and (ii) the exporter public key; and the computer system activating the master key in the first HSM. the computer system transmitting a first command to a source HSM to create a master key, the first command being signed by an administrator of HSMs in the HSM cluster; the computer system receiving, from the source HSM, a fingerprint of the master key in a response signed by the source HSM using a module signing key hardcoded into the source HSM at a manufacturing time of the source HSM; the computer system transmitting a second command to a first HSM in the HSM cluster, the second command generating an importer key pair comprising an importer private key and an importer public key; in response to the transmitting the second command, the computer system receiving the importer public key from the first HSM; the computer system transmitting to the source HSM a request to export the master key and the importer public key; in response to the transmitting the request, the computer system receiving from the source HSM (i) the master key wrapped with a transport key and (ii) an exporter public key, the transport key derived from the importer public key and an exporter private key; the computer system transmitting, to the first HSM, (i) the master key wrapped with the transport key and (ii) the exporter public key; and the computer system activating the master key in the first HSM.