A computer-implemented method for a prover to implement a cryptographic protocol, the computer-implemented method comprising: generating a first cryptographic key pair comprising a first public key ( PKi) and a first private key ( sk 1); generating a second cryptographic key pair comprising a second public key ( PK 2) and a second private key ( sk 2); constructing a compensation key ( ck) from the first and second private keys ( sk 1; sk 2), the compensation key ( ck) enabling the second private key ( sk 2) to be computed in the event that the first private key ( sk 1) is revealed; constructing a cryptographic proof that the compensation key ( ck) enables the second private key ( sk 2) to be computed in the event that the first private key ( sk 1) is revealed, the cryptographic proof not requiring the first and second private keys ( sk 1; sk 2) to be revealed; and sending the first and second public keys ( PK 1; PK 2), the compensation key ( ck), and the cryptographic proof to a verifier in order for the verifier to authenticate the cryptographic proof that the compensation key ( ck) enables the second private key ( sk 2) to be computed in the event that the first private key ( sk 1) is revealed; wherein the cryptographic proof is a non-interactive zero knowledge proof based on a zero-knowledge sigma (Σ) protocol converted to a non-interactive zero knowledge proof through application of a Fiat-Shamir heuristic; wherein the compensation key is calculated by: ck = sk 2. sk 1 − 1 mod n where ck is the compensation key, sk 1 is the first secret key, sk 2 is the second secret key, and n is an order of a generator point G used to generate the first and second public keys from the first and second private keys, generation of the first and second public keys including an elliptic curve point multiplication of the elliptic curve generator point G; and wherein the cryptographic proof is constructed by: generating a secure random number r; computing a commitment R = r × G, R x being an x -coordinate of the point R; computing a hash H ( R x), set x being the left-most l n bits of H where l n is the bit length of n; computing z = sk 1 x + r; where the cryptographic proof is a tuple π = ( ck, R, x, z). generating a first cryptographic key pair comprising a first public key ( PKi) and a first private key ( sk 1); generating a second cryptographic key pair comprising a second public key ( PK 2) and a second private key ( sk 2); constructing a compensation key ( ck) from the first and second private keys ( sk 1; sk 2), the compensation key ( ck) enabling the second private key ( sk 2) to be computed in the event that the first private key ( sk 1) is revealed; constructing a cryptographic proof that the compensation key ( ck) enables the second private key ( sk 2) to be computed in the event that the first private key ( sk 1) is revealed, the cryptographic proof not requiring the first and second private keys ( sk 1; sk 2) to be revealed; and sending the first and second public keys ( PK 1; PK 2), the compensation key ( ck), and the cryptographic proof to a verifier in order for the verifier to authenticate the cryptographic proof that the compensation key ( ck) enables the second private key ( sk 2) to be computed in the event that the first private key ( sk 1) is revealed; wherein the cryptographic proof is a non-interactive zero knowledge proof based on a zero-knowledge sigma (Σ) protocol converted to a non-interactive zero knowledge proof through application of a Fiat-Shamir heuristic; wherein the compensation key is calculated by: ck = sk 2. sk 1 − 1 mod n where ck is the compensation key, sk 1 is the first secret key, sk 2 is the second secret key, and n is an order of a generator point G used to generate the first and second public keys from the first and second private keys, generation of the first and second public keys including an elliptic curve point multiplication of the elliptic curve generator point G; and wherein the cryptographic proof is constructed by: generating a secure random number r; computing a commitment R = r × G, R x being an x -coordinate of the point R; computing a hash H ( R x), set x being the left-most l n bits of H where l n is the bit length of n; computing z = sk 1 x + r; generating a secure random number r; computing a commitment R = r × G, R x being an x -coordinate of the point R; computing a hash H ( R x), set x being the left-most l n bits of H where l n is the bit length of n; computing z = sk 1 x + r;