A method executable on a local processing device including a secure subsystem and a system memory, the method comprising: obtaining a factory key (UFPK) from the system memory; obtaining an authentication key (MACK) from the system memory; transmitting the factory key (UFPK) and the authentication key (MACK) to a remote system; receiving, from the remote system, an encrypted factory key (UFPK of KB E) based at least partially on the factory key (UFPK) and an encrypted authentication key (MACK of KB E) based at least partially on the authentication key (MACK); obtaining an application key from the system memory; generating a first authentication code based at least partially on the authentication key (MACK) and the application key; encrypting the application key with the factory key (UFPK) to generate an encrypted application key (AK E); transmitting to the secure subsystem the encrypted authentication key (MACK of KB E), the encrypted application key (AK E), and the first authentication code; transmitting the encrypted factory key (UFPK of KB E) to the secure subsystem; decrypting, at the secure subsystem, the encrypted factory key (UFPK of KB E) to obtain a decrypted factory key (UFPK D); decrypting, at the secure subsystem, the encrypted authentication key (MACK of KB E) to obtain a decrypted authentication key (MACK D); decrypting, at the secure subsystem, the encrypted application key (AK E) with the decrypted factory key (UFDK D) to obtain a decrypted application key (AK D); generating, at the secure subsystem, a second authentication code (MACv) based at least partially on the decrypted authentication key (MACK D) and the decrypted application key (AK D); accepting the decrypted authentication key (AK D) as authentic in accordance with a determination that the first authentication code and the second authentication code (MACv) satisfy an authentication criterion; obtaining, at the secure subsystem, a device identifier (uID) from the system memory; generating a device authentication key (uMAC) based partially on the device identifier (uID) and the accepted authentication key (AK D); generating, at the secure subsystem, a secure application key (AKs) including the device authentication key (uMAC) and the accepted authentication key (AK D). obtaining a factory key (UFPK) from the system memory; obtaining an authentication key (MACK) from the system memory; transmitting the factory key (UFPK) and the authentication key (MACK) to a remote system; receiving, from the remote system, an encrypted factory key (UFPK of KB E) based at least partially on the factory key (UFPK) and an encrypted authentication key (MACK of KB E) based at least partially on the authentication key (MACK); obtaining an application key from the system memory; generating a first authentication code based at least partially on the authentication key (MACK) and the application key; encrypting the application key with the factory key (UFPK) to generate an encrypted application key (AK E); transmitting to the secure subsystem the encrypted authentication key (MACK of KB E), the encrypted application key (AK E), and the first authentication code; transmitting the encrypted factory key (UFPK of KB E) to the secure subsystem; decrypting, at the secure subsystem, the encrypted factory key (UFPK of KB E) to obtain a decrypted factory key (UFPK D); decrypting, at the secure subsystem, the encrypted authentication key (MACK of KB E) to obtain a decrypted authentication key (MACK D); decrypting, at the secure subsystem, the encrypted application key (AK E) with the decrypted factory key (UFDK D) to obtain a decrypted application key (AK D); generating, at the secure subsystem, a second authentication code (MACv) based at least partially on the decrypted authentication key (MACK D) and the decrypted application key (AK D); accepting the decrypted authentication key (AK D) as authentic in accordance with a determination that the first authentication code and the second authentication code (MACv) satisfy an authentication criterion; obtaining, at the secure subsystem, a device identifier (uID) from the system memory; generating a device authentication key (uMAC) based partially on the device identifier (uID) and the accepted authentication key (AK D); generating, at the secure subsystem, a secure application key (AKs) including the device authentication key (uMAC) and the accepted authentication key (AK D).