1. A method comprising: receiving from a virtual machine (“VM”) a creation request for a key of a first key type; mapping, in a virtual trusted platform module (“vTPM”), the first key type to a second key type via a table that maps vTPM key types to hardware trusted platform module (“hTPM”) key types as a function of the key type requested; requesting and receiving, from a hTPM, an instantiated hTPM key of the second type, wherein the instantiated key is a child of a root key of the vTPM, wherein the instantiated hTPM key includes public and private portions, and the private portion is a wrapped key; encrypting both the public and private portions of the instantiated hTPM key, using a first key of the vTPM, to form a private key portion; creating a public key portion; assembling the public and private key portions to generate a vTPM key, wherein the private portion of the vTPM key is a double wrapped key having a pointer to a logical parent of the vTPM key; and sending the vTPM key to the VM.