Cryptoasset custodial system with different cryptographic keys controlling access to separate groups of private keys

A method comprising:

• receiving, by one or more server computers of a cryptoasset custodial system, a request to take an action in the cryptoasset custodial system;
• identifying, by the one or more server computers, for the action an associated private-keys group out of multiple different private-keys groups managed by the cryptoasset custodial system, wherein each of the multiple different private-keys groups has an associated cryptographic group key;
• transmitting, by the one or more server computers, at least a doubly encrypted private key associated with the action to a corresponding one of two or more physical datacenters, each of the two or more physical datacenters employing an air gap to isolate internal components from an outside network and including a first computer and two or more hardware security modules connected with the first computer, each of the two or more hardware security modules comprising at least one secure storage device and at least one physical computing device coupled with the at least one secure storage device;
• decrypting, at the first computer within the corresponding physical datacenter and protected by the air gap, a first level of encryption of the doubly encrypted private key associated with the action using the associated cryptographic group key for the associated private-keys group out of the multiple different private-keys groups managed by the cryptoasset custodial system;
• transmitting, by the first computer within the corresponding physical datacenter, the partially decrypted private key to one of the two or more hardware security modules within the corresponding physical datacenter;
• decrypting, at the one of the two or more hardware security modules within the corresponding physical datacenter and protected by the air gap, a second level of encryption of the doubly encrypted private key associated with the action using a hardware-based cryptographic key used by the one of the two or more hardware security modules, wherein the hardware-based cryptographic key is shared among multiple hardware security modules located in the two more physical datacenters;
• using, at the one of the two or more hardware security modules, the fully decrypted private key associated with the action in a process of digitally signing data to authorize the action;
• and
• transmitting, by the one of the two or more hardware security modules, the digitally signed data to a third computer to effect the action.