1. A method comprising: executing, by one or more micro-processors, in a trusted execution environment of the one or more micro-processors, one or more trusted execution environment processes; cryptographically protecting, by the one or more micro-processors, using the one or more trusted execution environment processes, a secret; cryptographically protecting, by the one or more micro-processors, using the one or more trusted execution environment processes, a policy such that modifications to the policy are detectable, the policy specifying a plurality of conditions on usage of the secret; executing, by the one or more micro-processors, outside the trusted execution environment, one or more non-trusted execution environment processes; generating, by the one or more micro-processors, using the one or more non-trusted execution environment processes, a request to perform an action requiring use of the secret; and responsive to the request: determining, by the one or more micro-processors, using the one or more non-trusted execution environment processes, that a first subset of the plurality of conditions is satisfied; responsive to the first subset of the plurality of conditions being satisfied, determining, by the one or more micro-processors, using the one or more trusted execution environment processes, that a second, different subset of the plurality of conditions is satisfied; and responsive to the second subset of the plurality of conditions being satisfied, performing, by the one or more micro-processors, using the one or more trusted execution environment processes and the secret the action.