Abstract: Various systems and methods for performing cryptographic operations based on an authentication policy are discussed. In an example, an authentication policy for implementing a user authentication factor (or multiple factors) may be deployed at a client computing device to control generation and use of a cryptographic key. Operations for generating a cryptographic key in accordance with an authentication policy may include: receiving the authentication policy from a policy broker, generating the cryptographic key in response to receipt of the user authentication factor defined by the authentication policy, generating attestation data that indicates compliance with the authentication policy, and communicating the attestation data to the policy broker.