A method for operating a security accelerator device (500, 502), comprising: storing, in non-volatile memory, a first credential that is uniquely associated with the security accelerator device (500, 502) and represents a root of trust to a trusted entity, wherein this first credential is a private key of a public/private key pair of the security accelerator device; receiving, by the security accelerator device, from a client entity, a symmetric wrapper key, SWK, that is encrypted with the public key of the security accelerator device (500, 502); establishing, by the security accelerator device (500, 502), a cryptographic trust relationship with the client entity that is based on the root of trust, the cryptographic trust relationship being represented by a second credential, wherein this second credential is the SWK decrypted by the security accelerator device (500, 502); receiving, from the client entity, a secret client credential belonging to the client entity that is encrypted with the SWK, and decrypting, by the security accelerator device (500, 502), this secret client credential; storing, by the security accelerator device (500, 502), the decrypted secret client credential; receiving, from the client entity, a message M that is encrypted with the SWK; executing, by the security accelerator device (500, 502), a cryptographic asymmetric key-related computation on the message M using the secret client credential on behalf of the client entity to produce a message N as the computation result; and encrypting, by the security accelerator device (500, 502), the message N with the SWK, and passing the encrypted message N back to the client entity. storing, in non-volatile memory, a first credential that is uniquely associated with the security accelerator device (500, 502) and represents a root of trust to a trusted entity, wherein this first credential is a private key of a public/private key pair of the security accelerator device; receiving, by the security accelerator device, from a client entity, a symmetric wrapper key, SWK, that is encrypted with the public key of the security accelerator device (500, 502); establishing, by the security accelerator device (500, 502), a cryptographic trust relationship with the client entity that is based on the root of trust, the cryptographic trust relationship being represented by a second credential, wherein this second credential is the SWK decrypted by the security accelerator device (500, 502); receiving, from the client entity, a secret client credential belonging to the client entity that is encrypted with the SWK, and decrypting, by the security accelerator device (500, 502), this secret client credential; storing, by the security accelerator device (500, 502), the decrypted secret client credential; receiving, from the client entity, a message M that is encrypted with the SWK; executing, by the security accelerator device (500, 502), a cryptographic asymmetric key-related computation on the message M using the secret client credential on behalf of the client entity to produce a message N as the computation result; and encrypting, by the security accelerator device (500, 502), the message N with the SWK, and passing the encrypted message N back to the client entity.