A method for providing digital certificates by entities (110, 150, 210, 220) operable to perform computing on digital values and to communicate with each other, the digital certificates being for use by devices in authentication operations, each device being one of the entities (110, 150. 210, 220), wherein each digital certificate includes the digital certificate's public key data for use by an associated device, the method comprising: receiving, by a first entity (150, 220), a request to generate a digital certificate, the request is one of a plurality of requests, each request being to generate the digital certificates, the first entity (150, 220) not being informed with which device each digital certificate is associated nor whether any different certificates are associated with the same device or different devices, wherein each digital certificate is to be transmitted to its associated device in an associated encrypted package from which the digital certificate is recoverable by the associated device using a private decryption key associated with the digital certificate, wherein the requests comprise, for each digital certificate, one of: (a) an associated signature-related key, and (b) an associated encryption-related key; wherein the method further comprises performing by the first entity (150, 220), for each digital certificate, operations of: generating, from said one of the associated signature-related key and the associated encryption-related key, the other one of the associated signature-related key and the associated encryption-related key; generating, from the associated signature-related key, the digital certificate's public key data, and generating an associated package comprising the digital certificate comprising the digital certificate's public key data; encrypting the associated package by using the associated encryption-related key, to generate the associated encrypted package; and transmitting the associated encrypted package for delivery to the associated device; wherein, for each digital certificate, the digital certificate's public key data and the encryption-related key are interrelated such that a modification of the encryption-related key is detectable by the associated device in a verification operation; wherein the encrypted packages are not signed by the first entity (150, 220). receiving, by a first entity (150, 220), a request to generate a digital certificate, the request is one of a plurality of requests, each request being to generate the digital certificates, the first entity (150, 220) not being informed with which device each digital certificate is associated nor whether any different certificates are associated with the same device or different devices, wherein each digital certificate is to be transmitted to its associated device in an associated encrypted package from which the digital certificate is recoverable by the associated device using a private decryption key associated with the digital certificate, wherein the requests comprise, for each digital certificate, one of: (a) an associated signature-related key, and (b) an associated encryption-related key; wherein the method further comprises performing by the first entity (150, 220), for each digital certificate, operations of: generating, from said one of the associated signature-related key and the associated encryption-related key, the other one of the associated signature-related key and the associated encryption-related key; generating, from the associated signature-related key, the digital certificate's public key data, and generating an associated package comprising the digital certificate comprising the digital certificate's public key data; encrypting the associated package by using the associated encryption-related key, to generate the associated encrypted package; and transmitting the associated encrypted package for delivery to the associated device; wherein, for each digital certificate, the digital certificate's public key data and the encryption-related key are interrelated such that a modification of the encryption-related key is detectable by the associated device in a verification operation; wherein the encrypted packages are not signed by the first entity (150, 220). generating, from said one of the associated signature-related key and the associated encryption-related key, the other one of the associated signature-related key and the associated encryption-related key; generating, from the associated signature-related key, the digital certificate's public key data, and generating an associated package comprising the digital certificate comprising the digital certificate's public key data; encrypting the associated package by using the associated encryption-related key, to generate the associated encrypted package; and transmitting the associated encrypted package for delivery to the associated device; wherein, for each digital certificate, the digital certificate's public key data and the encryption-related key are interrelated such that a modification of the encryption-related key is detectable by the associated device in a verification operation; wherein the encrypted packages are not signed by the first entity (150, 220).