A system includes processor(s) and memory(s). When encryption key(s) need to be generated to encrypt a key, processor(s): generate encryption key(s); encrypt key using encryption key(s) to generate encrypted key; split encrypted key and encryption key(s) into set(s) of key components, wherein subset of key components can be used to reconstruct encrypted key and encryption key(s); and erase key from memory(s). When encryption key(s) need to be used, processor(s): receive set(s) of key components from subset(s) of users that can be used to reconstruct encrypted key and encryption key(s) used to decrypt key from encrypted key; when set(s) of key components is received from subset(s) of users that can be used to reconstruct encrypted key and encrypted key(s), reconstruct encrypted key and encryption key(s); and when the encrypted key and the encryption key(s) have both been reconstructed, decrypt encrypted key into key using encryption key(s).