A method implemented at least in part by computer-executable instructions executed by a transaction device, the method comprising: receiving, by the transaction device, from one or more computers, a first key that is encrypted using a second uniquely derived key to form an encrypted first key, the first key being a cryptographic signing key configured at least to cryptographically sign transaction data, the second uniquely derived key formed at least in part from an account number corresponding to an account associated with transactions by a user of the transaction device; independently forming, by the transaction device, the second uniquely derived key from the account number corresponding to the account associated with transactions by the user of the transaction device; responsive to receiving the encrypted first key and independent of user input to the transaction device, decrypting the encrypted first key with the independently formed second uniquely derived key to obtain the unencrypted first key that is the cryptographic signing key and without receiving the second uniquely derived key from the one or more computers; signing, by the transaction device, transaction data; and providing the signed transaction data to an access device, which generates a transaction authorization request with respect to a transaction associated with the account number, the transaction authorization request including the transaction data signed using the unencrypted first key that was provided in encrypted form by the one or more computers, wherein the one or more computers determine that the transaction device is an authentic initiator of the transaction authorization request at least in part by verifying that the transaction data in the transaction authorization request was signed using the unencrypted first key that was provided in encrypted form by the one or more computers. receiving, by the transaction device, from one or more computers, a first key that is encrypted using a second uniquely derived key to form an encrypted first key, the first key being a cryptographic signing key configured at least to cryptographically sign transaction data, the second uniquely derived key formed at least in part from an account number corresponding to an account associated with transactions by a user of the transaction device; independently forming, by the transaction device, the second uniquely derived key from the account number corresponding to the account associated with transactions by the user of the transaction device; responsive to receiving the encrypted first key and independent of user input to the transaction device, decrypting the encrypted first key with the independently formed second uniquely derived key to obtain the unencrypted first key that is the cryptographic signing key and without receiving the second uniquely derived key from the one or more computers; signing, by the transaction device, transaction data; and providing the signed transaction data to an access device, which generates a transaction authorization request with respect to a transaction associated with the account number, the transaction authorization request including the transaction data signed using the unencrypted first key that was provided in encrypted form by the one or more computers, wherein the one or more computers determine that the transaction device is an authentic initiator of the transaction authorization request at least in part by verifying that the transaction data in the transaction authorization request was signed using the unencrypted first key that was provided in encrypted form by the one or more computers.