A method for digitally signing data using a cryptographic key in a communication network comprising a server node (110, 210, 310) and at least one further network node (120, 220, 320), the method comprising the following steps: (a) generating a cryptographic public key/private key pair using cryptographic key generation means (130, 230, 330), wherein said key pair is not associated with any Subject's identity (b) at the server node (110, 210, 310), storing said public key in a public key store (140, 240, 340), and (c) storing said private key in a private key store (150, 250, 350), access to which is granted using a predetermined associated primary authentication factor and at least one yet undefined supplementary authentication factor; (d) subsequently providing an unidentified user, the Subscriber, with said primary authentication factor, said Subscriber being associated with an identifiable Subject yet unknown to the server node; (e) defining the at least one yet undefined supplementary authentication factor in association with said private key store (150, 250, 350) with data chosen by, and proprietary to, said Subscriber, thereby uniquely associating said private key store (150, 250, 350) and said key pair to the Subject associated with said Subscriber; (f) subsequently receiving, at the server node (110, 210, 310) from at least one network node (120, 220, 320), data (124, 224, 324) identifying said Subscriber and the associated Subject, said data (124, 224, 324) being cryptographically signed with said private key using digital signature creation means (160, 260, 360); (g) at the server node (110, 210, 310), verifying and validating said received data (124, 224, 324), and associating the so-identified Subject with said key pair; (h) at any one of said network nodes (120, 220, 320), causing data to be cryptographically signed with said private key using digital signature creation means (160, 260, 360), said signed data being certifiable to have been signed by said Subject, based on the corresponding public key and the Subject associated therewith. (a) generating a cryptographic public key/private key pair using cryptographic key generation means (130, 230, 330), wherein said key pair is not associated with any Subject's identity (b) at the server node (110, 210, 310), storing said public key in a public key store (140, 240, 340), and (c) storing said private key in a private key store (150, 250, 350), access to which is granted using a predetermined associated primary authentication factor and at least one yet undefined supplementary authentication factor; (d) subsequently providing an unidentified user, the Subscriber, with said primary authentication factor, said Subscriber being associated with an identifiable Subject yet unknown to the server node; (e) defining the at least one yet undefined supplementary authentication factor in association with said private key store (150, 250, 350) with data chosen by, and proprietary to, said Subscriber, thereby uniquely associating said private key store (150, 250, 350) and said key pair to the Subject associated with said Subscriber; (f) subsequently receiving, at the server node (110, 210, 310) from at least one network node (120, 220, 320), data (124, 224, 324) identifying said Subscriber and the associated Subject, said data (124, 224, 324) being cryptographically signed with said private key using digital signature creation means (160, 260, 360); (g) at the server node (110, 210, 310), verifying and validating said received data (124, 224, 324), and associating the so-identified Subject with said key pair; (h) at any one of said network nodes (120, 220, 320), causing data to be cryptographically signed with said private key using digital signature creation means (160, 260, 360), said signed data being certifiable to have been signed by said Subject, based on the corresponding public key and the Subject associated therewith.