A method, performed at a server device of a hearing system, for remote configuration of a hearing device in the hearing system, the hearing system comprising the hearing device, a user application installed on an accessory device, a fitting device and the server device, the method comprising: - receiving a configuration initiation request from the fitting device, the configuration initiation request comprising a hearing device identifier, and a session key, wherein the session key is in encrypted form using a configuration initiation public key; - decrypting the session key using a configuration initiation private key corresponding to the configuration initiation public key; - generating configuration keying material based on the session key, wherein the configuration keying material comprises a configuration session key, wherein generating the configuration keying material based on the session key comprises encrypting (S202a) the configuration session key using the session key, and including the encrypted configuration session key into the configuration keying material; - generating configuration authentication material; - transmitting a configuration initiation response to the fitting device, the configuration initiation response comprising the configuration keying material; - receiving a configuration package from the fitting device, the configuration package comprising a configuration payload block and a control block, wherein the configuration payload block comprises configuration data encrypted, by the fitting device, using the configuration keying material comprising the configuration key; - calculating, based on the configuration payload block and the control block, an integrity indicator set comprising a first integrity indicator and a second integrity indicator, by computing the first integrity indicator based on the configuration payload block and by computing the second integrity indicator based on the control block; - generating a configuration block based on at least part of the integrity indicator set, wherein the configuration block comprises the first integrity indicator and the second integrity indicator; - generating a configuration verification package based on the configuration block; - generating a configuration authentication package based on the configuration authentication material; and - transmitting the configuration package, the configuration verification package and the configuration authentication package. - receiving a configuration initiation request from the fitting device, the configuration initiation request comprising a hearing device identifier, and a session key, wherein the session key is in encrypted form using a configuration initiation public key; - decrypting the session key using a configuration initiation private key corresponding to the configuration initiation public key; - generating configuration keying material based on the session key, wherein the configuration keying material comprises a configuration session key, wherein generating the configuration keying material based on the session key comprises encrypting (S202a) the configuration session key using the session key, and including the encrypted configuration session key into the configuration keying material; - generating configuration authentication material; - transmitting a configuration initiation response to the fitting device, the configuration initiation response comprising the configuration keying material; - receiving a configuration package from the fitting device, the configuration package comprising a configuration payload block and a control block, wherein the configuration payload block comprises configuration data encrypted, by the fitting device, using the configuration keying material comprising the configuration key; - calculating, based on the configuration payload block and the control block, an integrity indicator set comprising a first integrity indicator and a second integrity indicator, by computing the first integrity indicator based on the configuration payload block and by computing the second integrity indicator based on the control block; - generating a configuration block based on at least part of the integrity indicator set, wherein the configuration block comprises the first integrity indicator and the second integrity indicator; - generating a configuration verification package based on the configuration block; - generating a configuration authentication package based on the configuration authentication material; and - transmitting the configuration package, the configuration verification package and the configuration authentication package.