A system comprising a client device and a host device comprising a trusted platform module and a trust broker module for causing a trust command to be performed using a cryptographic asset, the system further comprising: one or more processors; and one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including: receiving, via a network interface of the host device, a device secret for the client device and the cryptographic asset for the client device, the device secret enabling usage of the cryptographic asset to be controlled; brokering, by the trust broker module, the provisioning of the device secret to the trusted platform module, TPM, of the host device, the brokering routing the device secret and the cryptographic asset from the network interface to the TPM; receiving, by the trust broker module, from the client device the trust command and the device secret; communicating, by the trust broker module, the trust command and the device secret to the TPM of the host device, authorizing by the TPM the trusted command using the device secret such that the trust command is performed by the TPM using the cryptographic asset; and communicating, by the trust broker module, a result of performing the trust command to the client device performing by the client device one or more actions based on the result of performing the trust command, characterized by the one or more actions comprise changing a configuration setting of the client device based on data included in the result of performing the trust command. one or more processors; and one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including: receiving, via a network interface of the host device, a device secret for the client device and the cryptographic asset for the client device, the device secret enabling usage of the cryptographic asset to be controlled; brokering, by the trust broker module, the provisioning of the device secret to the trusted platform module, TPM, of the host device, the brokering routing receiving, via a network interface of the host device, a device secret for the client device and the cryptographic asset for the client device, the device secret enabling usage of the cryptographic asset to be controlled; brokering, by the trust broker module, the provisioning of the device secret to the trusted platform module, TPM, of the host device, the brokering routing the device secret and the cryptographic asset from the network interface to the TPM; receiving, by the trust broker module, from the client device the trust command and the device secret; communicating, by the trust broker module, the trust command and the device secret to the TPM of the host device, authorizing by the TPM the trusted command using the device secret such that the trust command is performed by the TPM using the cryptographic asset; and communicating, by the trust broker module, a result of performing the trust command to the client device performing by the client device one or more actions based on the result of performing the trust command, characterized by the one or more actions comprise changing a configuration setting of the client device based on data included in the result of performing the trust command. receiving, by the trust broker module, from the client device the trust command and the device secret; communicating, by the trust broker module, the trust command and the device secret to the TPM of the host device, authorizing by the TPM the trusted command using the device secret such that the trust command is performed by the TPM using the cryptographic asset; and communicating, by the trust broker module, a result of performing the trust command to the client device performing by the client device one or more actions based on the result of performing the trust command, characterized by the one or more actions comprise changing a configuration setting of the client device based on data included in the result of performing the trust command.