A computer-implemented method for management of service keys for a consortium blockchain network within a blockchain-as-a-service, BaaS, platform, the method comprising, for each of a first participant and a second participant: at the BaaS platform: receiving an encrypted identity certificate from the participant, the identity certificate comprising a public key wherein, the BaaS platform decrypts the identity certificate using a public key of the participant; receiving a request for a service key from the participant in the consortium blockchain network provisioned within the BaaS platform; determining that the participant is authorized for the service key based on a service authorization table that records participant privileges within the consortium blockchain network; generating the service key; encrypting a private key of the service key using the public key comprised within the identity certificate of the participant; providing a key package comprising the encrypted private key of the service key, and a public key of the service key, wherein neither the public nor the private key of the service key is stored on the BaaS platform; and sending the key package to the participant; and at the participant: receiving the key package; and decrypting the private key of the service key using a private key associated with the identity certificate of the participant; wherein, the service key of the first participant and the service key of the second participant are public-private key pairs that enable private transactions to be conducted between the first participant and the second participant within the consortium blockchain network. at the BaaS platform: receiving an encrypted identity certificate from the participant, the identity certificate comprising a public key wherein, the BaaS platform decrypts the identity certificate using a public key of the participant; receiving a request for a service key from the participant in the consortium blockchain network provisioned within the BaaS platform; determining that the participant is authorized for the service key based on a service authorization table that records participant privileges within the consortium blockchain network; generating the service key; encrypting a private key of the service key using the public key comprised within the identity certificate of the participant; providing a key package comprising the encrypted private key of the service key, and a public key of the service key, wherein neither the public nor the private key of the service key is stored on the BaaS platform; and sending the key package to the participant; and receiving an encrypted identity certificate from the participant, the identity certificate comprising a public key wherein, the BaaS platform decrypts the identity certificate using a public key of the participant; receiving a request for a service key from the participant in the consortium blockchain network provisioned within the BaaS platform; determining that the participant is authorized for the service key based on a service authorization table that records participant privileges within the consortium blockchain network; generating the service key; encrypting a private key of the service key using the public key comprised within the identity certificate of the participant; providing a key package comprising the encrypted private key of the service key, and a public key of the service key, wherein neither the public nor the private key of the service key is stored on the BaaS platform; and sending the key package to the participant; and at the participant: receiving the key package; and decrypting the private key of the service key using a private key associated with the identity certificate of the participant; wherein, the service key of the first participant and the service key of the second participant are public-private key pairs that enable private transactions to be conducted between the first participant and the second participant within the consortium blockchain network. receiving the key package; and decrypting the private key of the service key using a private key associated with the identity certificate of the participant; wherein, the service key of the first participant and the service key of the second participant are public-private key pairs that enable private transactions to be conducted between the first participant and the second participant within the consortium blockchain network.