A method for operating a computing system, comprising: generating with a trusted processor a first secret cryptographic key based on a physically unclonable function in at least one hardware component in the trusted processor, the first secret cryptographic key being unavailable to other components in the computing system; generating with the trusted processor a first asymmetric cryptographic key pair with reference to the first secret cryptographic key and a predetermined asymmetric cryptographic key generation process, the first asymmetric cryptographic key pair including a first public key and a first private key; executing with the trusted processor instruction code stored in a volatile cache memory corresponding to a first software program; generating with the trusted processor a first hash value corresponding to the instruction code of the first software program; generating with the trusted processor authentication data for the first encrypted data; transmitting with an input/output (I/O) interface operatively connected to the trusted processor the first encrypted data and the authentication data for storage in an untrusted memory, generating with the trusted processor a second secret cryptographic key with reference to the first secret cryptographic key and the first hash value, the second secret cryptographic key being unavailable to other components in the computing system; and the generated authentication data being message authentication code corresponding to the encrypted data with reference to the second secret key, receiving with the I/O interface operatively connected to the trusted processor second encrypted data corresponding to the second secret cryptographic key from a verifier computing device that is external to the trusted processor; decrypting with the trusted processor the second encrypted data corresponding to the second secret cryptographic key with the first private key; receiving with the I/O interface operatively connected to the trusted processor the encrypted data and the message authentication code from the untrusted memory; verifying with the trusted processor the message authentication code with reference to the second secret cryptographic key; generating with the trusted processor decrypted data for the first software program with reference to the second secret cryptographic key only in response to successful verification of the message authentication code, and transmitting with the I/O interface operatively connected to the trusted processor the second encrypted data to the verifier computing device. generating with a trusted processor a first secret cryptographic key based on a physically unclonable function in at least one hardware component in the trusted processor, the first secret cryptographic key being unavailable to other components in the computing system; generating with the trusted processor a first asymmetric cryptographic key pair with reference to the first secret cryptographic key and a predetermined asymmetric cryptographic key generation process, the first asymmetric cryptographic key pair including a first public key and a first private key; executing with the trusted processor instruction code stored in a volatile cache memory corresponding to a first software program; generating with the trusted processor a first hash value corresponding to the instruction code of the first software program; generating with the trusted processor authentication data for the first encrypted data; transmitting with an input/output (I/O) interface operatively connected to the trusted processor the first encrypted data and the authentication data for storage in an untrusted memory, generating with the trusted processor a second secret cryptographic key with reference to the first secret cryptographic key and the first hash value, the second secret cryptographic key being unavailable to other components in the computing system; and the generated authentication data being message authentication code corresponding to the encrypted data with reference to the second secret key, receiving with the I/O interface operatively connected to the trusted processor second encrypted data corresponding to the second secret cryptographic key from a verifier computing device that is external to the trusted processor; decrypting with the trusted processor the second encrypted data corresponding to the second secret cryptographic key with the first private key; receiving with the I/O interface operatively connected to the trusted processor the encrypted data and the message authentication code from the untrusted memory; verifying with the trusted processor the message authentication code with reference to the second secret cryptographic key; generating with the trusted processor decrypted data for the first software program with reference to the second secret cryptographic key only in response to successful verification of the message authentication code, and transmitting with the I/O interface operatively connected to the trusted processor the second encrypted data to the verifier computing device.