The disclosed technology is generally directed to secure key storage. A secret device key may be mutated based on a hash of a first boot loader to derive a first mutated key. The first mutated key may be mutated based on a random seed to derive a second mutated key. The second mutated key may be used to encrypt the hash of the runtime for a first core. The second mutated key may be mutated based on a hash of the runtime of the first execution environment for the second core to derive a third mutated key. The second mutated key may be used to encrypt the hash of the runtime of the first execution environment. The encrypted keys and hashes may be stored in a secure key store.