Cryptoasset custodial system using encrypted and distributed client keys

A hardware security module (HSM) generates a client key for an account holder of a cryptoasset custodial system. The HSM encrypts the client key to generate an encrypted client key using a hardware-based cryptographic key within a secure storage device. The encrypted client key is transmitted to client devices. The HSM deletes the encrypted client key from the secure storage device. Each client device stores the encrypted client key in an offline secure enclave. A request to authorize a cryptoasset transaction is received. The HSM determines that signed messages endorsing the cryptoasset transaction have been received from at least some client devices in satisfaction of a quorum. The encrypted client key is received from at least one client device. The HSM decrypts the encrypted client key. The HSM signs an approval message for the cryptoasset transaction using a cryptoasset key based at least in part on the client key.