Abstract: Methods and systems for secure storage and retrieval of information, such as private keys, useable to control access to a blockchain, include: receiving, in a cryptoasset custodial system, a request to authorize a staking operation associated with a blockchain, wherein the staking operation is associated with a private key of an asymmetric cryptographic key pair, the private key is usable to control ownership of a cryptoasset recorded in the blockchain, and the private key is securely held in the custodial system; performing, in response to the request, a portion of the proof-of-stake protocol in a hardware security module using logic designed for the protocol, wherein the logic in the hardware security module is configured to authorize the staking operation by digitally signing an associated staking transaction; and sending the digitally signed staking transaction to another computer to effect the staking operation on behalf of the user.

Abstract: Methods, and systems for secure storage and retrieval of information, such as private keys, useable to control access to a blockchain, include: receiving a request to take an action with respect to a vault of multiple different vaults in a cryptoasset custodial system, and each of the multiple different vaults has an associated policy map that defines vault control rules; authenticating, by a hardware security module, a policy map for the vault on which the action is requested based on a cryptographic key controlled by the hardware security module; checking the action against the policy map for the vault when the policy map for the vault is authenticated based on the cryptographic key controlled by the hardware security module; and effecting the action when the action is confirmed to be in accordance with the policy map for the vault.

Abstract: Methods and systems including: receiving a request to take an action in a cryptoasset custodial system for an account holder; authenticating a policy map associated with the action, wherein the policy map defines access control rules governing which actions are allowed under conditions including a threshold number of endorsements needed; and validating endorsement messages for the action by checking digital signatures of the received endorsement messages, wherein at least one of the validated endorsement messages has been generated by digital signing with a first private key of a person, who is associated with the account holder, and at least one of the validated endorsement messages has been generated by digital signing with a second private key of a program, which is associated with the account holder, responsive to the program confirming one or more circumstances specified by the account holder are met at a time when the program is run.