A method for distribution of device key sets over a network, the method comprising: generating a provisioning request including a protected software environment key agreement public key in a protected software environment, PSE, of a client device, and sending the provisioning request along with a PSE hash and a PSE signature to a quoting enclave of the client device to obtain a quote and an enhanced privacy ID, EPID, signature; obtaining from a crypto hardware, CH, token, belonging to a user, a token signature for the provisioning request and a token certificate; combining the provisioning request, the quote, the EPID signature, the token signature, and the token certificate using untrusted software to form a provisioning message, and transmitting the provisioning message from the client device to an attestation proxy server, APS, using a first network connection; attaching an APS signature and an APS certificate to the provisioning message based on a result of a verification of the EPID signature in an attestation server, and transmitting the provisioning message along with the APS signature and the APS certificate from the APS to an online provisioning server, OPS, using a second network connection; generating a provisioning response in OPS that includes an encrypted device key set, and delivering the provisioning response to the PSE using the first and second network connections, wherein the PSE decrypts the encrypted device key set included with the provisioning response to obtain the device key set, re-encrypts the device key set with a local chip-specific sealing key, and stores the re-encrypted device key set generating a provisioning request including a protected software environment key agreement public key in a protected software environment, PSE, of a client device, and sending the provisioning request along with a PSE hash and a PSE signature to a quoting enclave of the client device to obtain a quote and an enhanced privacy ID, EPID, signature; obtaining from a crypto hardware, CH, token, belonging to a user, a token signature for the provisioning request and a token certificate; combining the provisioning request, the quote, the EPID signature, the token signature, and the token certificate using untrusted software to form a provisioning message, and transmitting the provisioning message from the client device to an attestation proxy server, APS, using a first network connection; attaching an APS signature and an APS certificate to the provisioning message based on a result of a verification of the EPID signature in an attestation server, and transmitting the provisioning message along with the APS signature and the APS certificate from the APS to an online provisioning server, OPS, using a second network connection; generating a provisioning response in OPS that includes an encrypted device key set, and delivering the provisioning response to the PSE using the first and second network connections, wherein the PSE decrypts the encrypted device key set included with the provisioning response to obtain the device key set, re-encrypts the device key set with a local chip-specific sealing key, and stores the re-encrypted device key set