<p>Organisational Digital Identity (ODI) commonly relies on keys controlled by a single entity, creating a single point of failure and preventing organisations from cryptographically enforcing custom access policies. Migrating to fully decentralised identity infrastructures is costly and time-consuming, especially in regulated e-governance systems. This paper addresses these limitations through an Information Systems Engineering contribution: the design and experimental validation of a Distributed Key Management System (DKMS) that secures a centrally managed, PKI-based ODI without replacing the existing infrastructure. Rather than introducing new cryptographic primitives, the DKMS selects and composes existing threshold signature schemes to cover the complete key management lifecycle, from generation and operational usage through to post-operational archiving, recovery, and destruction. Partial custody through threshold signatures distributes control over an organisation’s signing key among multiple semi-trusted representatives, while remaining fully backwards compatible with standard RSA and ECDSA verification. A semi-automated signer mechanism is introduced to enforce human-in-the-loop policies without prohibitive latency. The design is validated through a proof-of-concept implementation for the X-Road data exchange system, evaluated across RSA and ECDSA threshold groups of sizes 2-of-2, 3-of-5, and 11-of-15. Results show that RSA-based DKMS achieves round-trip times comparable to single-party hardware tokens, confirming DKMS-based signing as a practical, zero-trust alternative to single-controller identity management.</p>