Chain of authentication using public key infrastructure

A method for conditionally delegating access to digital content using hierarchical public key infrastructure, the method comprising:

• generating, for a first party, a first public key corresponding to a first private key and a second public key corresponding to a second private key different from the first private key, the first public key being configured to authenticate access to digital content of the first party, and the second public key being configured to authenticate access only to a predetermined subset of digital content;
• signing the second public key with the first private key of the first party and transmitting the signed second public key to a second party;
• storing the second private key in a cloud-based key vault;
• receiving a biometric signature from a party seeking to activate the second public key;
• cross-signing the biometric signature using two or more certification authorities (CAs), each CA having issued a PKI certificate for multi-signing, to produce a cross-signed activation credential;
• and
• releasing the second private key from the cloud-based key vault and activating the second public key upon verification of the cross-signed activation credential, thereby granting the second party authenticated access to the predetermined subset of the digital content,
• wherein the first public key includes a first code and the second public key includes a second code, the first code and the second code being different from each other, the first code being associated with biometric data of the first party, and the second code being associated with biometric data of the second party.