Private key security in the cloud

A method of a certificate authority providing to a user an anonymous user signature on a message in a distributed decentralized network, the method comprising:

• obtaining, by the certificate authority, a credential for the user, the credential comprising a certificate signed by a root certificate authority on the network, wherein the certificate comprises a user public key and a plurality of user attributes;
• receiving, by a certificate authority on the network and from the user, a request for a signature on the message, wherein the request comprises the message to be signed and an indication of a subset of the plurality of user attributes to be revealed to a recipient;
• accessing, from a hardware security module on the network, a user secret key corresponding to the user public key in the credential;
• and
• providing, by the certificate authority and to the user, at least the message signed by the user secret key and a zero-knowledge proof, wherein the zero-knowledge proof establishes that the message is signed by the user secret key corresponding to the user public key in the credential without revealing the plurality of user attributes,
• whereby the user sends the subset of user attributes, the zero-knowledge proof, and the message signed by the user secret key corresponding to the user pubic key in the credential to the recipient, who confirms at least that the message is signed by the user secret key corresponding to the user public key in the credential without obtaining the plurality of user attributes.