Controlling who can use cryptographic keys and services