A destination data processing system (DPS) receives a key migration block from a source DPS. The key migration block includes an encrypted version of a primary key. The destination DPS receives user input that identifies (a) an authentication policy and (b) a context policy. The destination DPS collects authentication data from the user, based on the identified authentication policy. The destination DPS collects context data, based on the identified context policy. The destination DPS uses the authentication data and the context data to decrypt the key migration block. The authentication data may comprise multiple types of authentication data, possibly including biometric data. The user may also input an index, and the destination DPS may use the index to retrieve a number from a random number server. The destination DPS may use that number to decrypt the key migration block. Other embodiments are described and claimed.