1. A method comprising: receiving from a virtual machine (“VM”) a creation request for a key of a first key type; mapping the first key type to a second key type; requesting and receiving, from a hardware trusted platform module (“hTPM”), an instantiated hTPM key of the second type, wherein the instantiated key is a child of a root key of an appropriate vTPM; encrypting both public and private portions of the instantiated hTPM key, using a key of the vTPM, to form a private key portion; creating a public key portion; assembling the public and private key portions to generate a vTPM key; and sending the vTPM key to the VM.