A target device having a system for provisioning the target device to access an account of an account provider, the target device comprising: a storage storing instructions that: direct generation of a certification of target authentication data of the target device using certification data, the certification indicating that a vouching device certifies that the target device is authorized to access the account and the certification being verifiable by the account provider using the verification data, wherein the vouching device having been provisioned to access the account and the account provider having verification data of the vouching device, wherein the verification data is a public key from a private / public key pair generated by the vouching device and the certification data is the private key from the private / public key pair; provision the target device to access the account, the provisioning including sending the certification to the account provider so that the account provider can verify the certification using the verification data, associate the target device with the account, and authenticate, using the target authentication data, that the target device is authorized to access the account; and provision the target device to access a bootstrap account of a bootstrap account provider using a multi-factor authentication, wherein the generation of the certification is directed in response to receiving an indication from the bootstrap account provider that the vouching device is provisioned to access the account of the account provider; a processor for executing the instructions stored in the storage; and wherein the instructions that direct the generation of a certification include instructions that send a request for the vouching device to certify the target authentication data and receive a response that includes the certification of the target authentication data. a storage storing instructions that: direct generation of a certification of target authentication data of the target device using certification data, the certification indicating that a vouching device certifies that the target device is authorized to access the account and the certification being verifiable by the account provider using the verification data, wherein the vouching device having been provisioned to access the account and the account provider having verification data of the vouching device, wherein the verification data is a public key from a private / public key pair generated by the vouching device and the certification data is the private key from the private / public key pair; provision the target device to access the account, the provisioning including sending the certification to the account provider so that the account provider can verify the certification using the verification data, associate the target device with the account, and authenticate, using the target authentication data, that the target device is authorized to access the account; and provision the target device to access a bootstrap account of a bootstrap account provider using a multi-factor authentication, wherein the generation of the certification is directed in response to receiving an indication from the bootstrap account provider that the vouching device is provisioned to access the account of the account provider; direct generation of a certification of target authentication data of the target device using certification data, the certification indicating that a vouching device certifies that the target device is authorized to access the account and the certification being verifiable by the account provider using the verification data, wherein the vouching device having been provisioned to access the account and the account provider having verification data of the vouching device, wherein the verification data is a public key from a private / public key pair generated by the vouching device and the certification data is the private key from the private / public key pair; provision the target device to access the account, the provisioning including sending the certification to the account provider so that the account provider can verify the certification using the verification data, associate the target device with the account, and authenticate, using the target authentication data, that the target device is authorized to access the account; and provision the target device to access a bootstrap account of a bootstrap account provider using a multi-factor authentication, wherein the generation of the certification is directed in response to receiving an indication from the bootstrap account provider that the vouching device is provisioned to access the account of the account provider; a processor for executing the instructions stored in the storage; and wherein the instructions that direct the generation of a certification include instructions that send a request for the vouching device to certify the target authentication data and receive a response that includes the certification of the target authentication data.