A computer-implemented method for performing a cryptographic operation by a computing device (102, 302, 502), the method comprising: receiving, at a protected application (108, 306, 520) executing on the computing device (102, 302, 502) from a trusted key custodian, a cryptographic key to be used in performing the cryptographic operation in response to future requests, the cryptographic key being received from the trusted key custodian in encrypted form, the computing device (102, 302, 502) storing instructions of the protected application (108, 306, 520) within a secure memory space (110, 308, 518), wherein the secure memory space (110, 308, 518) is allocated and managed by a chip set (103, 303, 510) of the computing device (102, 302, 502); sending, by the protected application (108, 306, 520) to a hardware security module, HSM, a request to decrypt the cryptographic key; receiving, by the protected application (108, 306, 520) from the HSM, the cryptographic key as decrypted by the HSM; generating, by the chip set (103, 303, 510), an encrypted key using the cryptographic key as decrypted by the HSM; receiving, at a network interface of the computing device (102, 302, 502) from a requesting device, a first request to perform the cryptographic operation on first data in the first request; retrieving, by the protected application (108, 306, 520) using the chip set (103, 303, 510), the encrypted key from the secure memory space (110, 308, 518); performing, by the protected application (108, 306, 520), the cryptographic operation on the first data using the encrypted key to obtain encrypted first data; and sending the encrypted first data to the requesting device, wherein the trusted key custodian is distinct from the computing device (102, 302, 502) and the HSM is distinct from the computing device (102, 302, 502). receiving, at a protected application (108, 306, 520) executing on the computing device (102, 302, 502) from a trusted key custodian, a cryptographic key to be used in performing the cryptographic operation in response to future requests, the cryptographic key being received from the trusted key custodian in encrypted form, the computing device (102, 302, 502) storing instructions of the protected application (108, 306, 520) within a secure memory space (110, 308, 518), wherein the secure memory space (110, 308, 518) is allocated and managed by a chip set (103, 303, 510) of the computing device (102, 302, 502); sending, by the protected application (108, 306, 520) to a hardware security module, HSM, a request to decrypt the cryptographic key; receiving, by the protected application (108, 306, 520) from the HSM, the cryptographic key as decrypted by the HSM; generating, by the chip set (103, 303, 510), an encrypted key using the cryptographic key as decrypted by the HSM; receiving, at a network interface of the computing device (102, 302, 502) from a requesting device, a first request to perform the cryptographic operation on first data in the first request; retrieving, by the protected application (108, 306, 520) using the chip set (103, 303, 510), the encrypted key from the secure memory space (110, 308, 518); performing, by the protected application (108, 306, 520), the cryptographic operation on the first data using the encrypted key to obtain encrypted first data; and sending the encrypted first data to the requesting device, wherein the trusted key custodian is distinct from the computing device (102, 302, 502) and the HSM is distinct from the computing device (102, 302, 502).