A network-enabled device (102, 200), comprising: a storage device; listening logic, coupled with the storage device, to wirelessly receive a plurality of key fragments from a corresponding plurality of peer devices (104-120, 200), to cause storage of the plurality of key fragments in the storage device, and to receive an encrypted provisioning message from a management device (122, 124); key generation logic, coupled with the storage device, to generate a decryption key based on the plurality of key fragments stored in the storage device and to decrypt the encrypted provisioning message using the decryption key, wherein the decryption key cannot be generated if fewer key fragments than a predetermined number of key fragments are stored in the storage device, and wherein the predetermined number is greater than or equal to two; and control logic, coupled with the key generation logic, to provision the network-enabled device (102, 200) in accordance with instructions included in the decrypted provisioning message, characterized in that the control logic is configured to provision the network-enabled device (102, 200) for management by the management device (122, 124) by: storing an authentication key obtained from the decrypted provisioning message in the storage device, authenticating subsequent control messages, and implementing the control instructions included in the control message in response to determining that the control message can be authenticated with the stored authentication key; and/or updating an identifier for the network-enabled device (102, 200) in response to an instruction included in the provisioning message; and/or configuring a connection to the management device (122, 124) in response to an instruction included in the provisioning message. a storage device; listening logic, coupled with the storage device, to wirelessly receive a plurality of key fragments from a corresponding plurality of peer devices (104-120, 200), to cause storage of the plurality of key fragments in the storage device, and to receive an encrypted provisioning message from a management device (122, 124); key generation logic, coupled with the storage device, to generate a decryption key based on the plurality of key fragments stored in the storage device and to decrypt the encrypted provisioning message using the decryption key, wherein the decryption key cannot be generated if fewer key fragments than a predetermined number of key fragments are stored in the storage device, and wherein the predetermined number is greater than or equal to two; and control logic, coupled with the key generation logic, to provision the network-enabled device (102, 200) in accordance with instructions included in the decrypted provisioning message, characterized in that the control logic is configured to provision the network-enabled device (102, 200) for management by the management device (122, 124) by: storing an authentication key obtained from the decrypted provisioning message in the storage device, authenticating subsequent control messages, and implementing the control instructions included in the control message in response to determining that the control message can be authenticated with the stored authentication key; and/or updating an identifier for the network-enabled device (102, 200) in response to an instruction included in the provisioning message; and/or configuring a connection to the management device (122, 124) in response to an instruction included in the provisioning message. storing an authentication key obtained from the decrypted provisioning message in the storage device, authenticating subsequent control messages, and implementing the control instructions included in the control message in response to determining that the control message can be authenticated with the stored authentication key; and/or updating an identifier for the network-enabled device (102, 200) in response to an instruction included in the provisioning message; and/or configuring a connection to the management device (122, 124) in response to an instruction included in the provisioning message.