1. A non-transitory computer-readable medium having computer-readable instructions stored thereon that, when executed by at least one of one or more computing devices, directs at least one of the one or more computing devices to: receive double encrypted secret material and metadata from a customer client device, the metadata comprising a validation identifier for at least one of a public provider key or a public vendor key; import the double encrypted secret material into a trusted execution environment, the double encrypted secret material being encrypted by the public provider key and the public vendor key; extract, by the trusted execution environment, vendor encrypted secret material from the double encrypted secret material by decrypting the double encrypted secret material with a private provider key, the secret material comprising secret key material; extract, by the trusted execution environment, secret material from the vendor encrypted secret material by decrypting the vendor encrypted secret material with a private vendor key; store the secret material within the trusted execution environment; receive an instruction to perform a cryptographic operation and an identifier of the secret material from the customer client device; and perform, by the trusted execution environment, the cryptographic operation using the secret material based in part on the identifier of the secret material and the metadata.