A processor comprising: a local key storage location not readable outside of the processor ; a backup key storage location not readable outside of the processor ; instruction hardware to receive a load-key instruction and a restore-key instruction, the load-key instruction having an operand to specify a source ; and execution hardware to perform a load-key operation, a save-key operation, and a restore-key operation, the load-key operation including loading a cryptographic key from the source into the local key storage location , the save-key operation including copying the cryptographic key from the local key storage location to the backup key storage location , and the restore-key operation including copying the cryptographic key from the backup key storage location to the local key storage location , the execution hardware to perform the load-key operation in response to the load-key instruction and the restore-key operation in response to the restore-key instruction; wherein a processor state maintains the content of the backup key storage location while the local key storage location is unpowered, wherein the processor further comprises control logic to cause a virtual machine exit in response to an attempt by a guest running in a virtual machine on the processor to execute the load-key instruction to load another cryptographic key into the local key storage location , allowing a virtual machine monitor to intercept the load-key instruction and the virtual machine monitor is to load the other cryptographic key from the source into the load key storage location for use by the guest. a local key storage location not readable outside of the processor ; a backup key storage location not readable outside of the processor ; instruction hardware to receive a load-key instruction and a restore-key instruction, the load-key instruction having an operand to specify a source ; and execution hardware to perform a load-key operation, a save-key operation, and a restore-key operation, the load-key operation including loading a cryptographic key from the source into the local key storage location , the save-key operation including copying the cryptographic key from the local key storage location to the backup key storage location , and the restore-key operation including copying the cryptographic key from the backup key storage location to the local key storage location , the execution hardware to perform the load-key operation in response to the load-key instruction and the restore-key operation in response to the restore-key instruction; wherein a processor state maintains the content of the backup key storage location while the local key storage location is unpowered, wherein the processor further comprises control logic to cause a virtual machine exit in response to an attempt by a guest running in a virtual machine on the processor to execute the load-key instruction to load another cryptographic key into the local key storage location , allowing a virtual machine monitor to intercept the load-key instruction and the virtual machine monitor is to load the other cryptographic key from the source into the load key storage location for use by the guest. <EOS>