A wireless device comprising: one or more antennas; an embedded Universal Integrated Circuit Card (120, 320), eUICC, communicatively coupled to the one or more antennas, the eUICC comprising a processor and a memory communicatively coupled to the processor and storing instructions that, when executed by the processor, cause the eUICC to perform operations comprising: providing, to a server via the wireless device, a request to establish a secure connection with the server, wherein the server is associated with a long-term server public key, PK server, provided by the server to the wireless device, and a long-term server private key, SK server, providing to the server via the wireless device: i) a signature produced using a long-term eUICC public key, PK eUICC, and ii) PK eUICC, authenticating the server using PK server, generating, subsequent to the authenticating, an ephemeral eUICC public key, ePK eUICC, and an ephemeral eUICC private key, eSK eUICC, providing, to the server via the wireless device, a signed ePK eUICC that is signed using a long-term eUICC private key, SK eUICC, receiving, from the server via the wireless device, an ephemeral server public key, ePK server, that is signed using using SK server, generating a shared symmetric key using eSK eUICC and ePK server, and establishing the secure connection with the server using the shared symmetric key. one or more antennas; an embedded Universal Integrated Circuit Card (120, 320), eUICC, communicatively coupled to the one or more antennas, the eUICC comprising a processor and a memory communicatively coupled to the processor and storing instructions that, when executed by the processor, cause the eUICC to perform operations comprising: providing, to a server via the wireless device, a request to establish a secure connection with the server, wherein the server is associated with a long-term server public key, PK server, provided by the server to the wireless device, and a long-term server private key, SK server, providing to the server via the wireless device: i) a signature produced using a long-term eUICC public key, PK eUICC, and ii) PK eUICC, authenticating the server using PK server, generating, subsequent to the authenticating, an ephemeral eUICC public key, ePK eUICC, and an ephemeral eUICC private key, eSK eUICC, providing, to the server via the wireless device, a signed ePK eUICC that is signed using a long-term eUICC private key, SK eUICC, receiving, from the server via the wireless device, an ephemeral server public key, ePK server, that is signed using using SK server, generating a shared symmetric key using eSK eUICC and ePK server, and establishing the secure connection with the server using the shared symmetric key. providing, to a server via the wireless device, a request to establish a secure connection with the server, wherein the server is associated with a long-term server public key, PK server, provided by the server to the wireless device, and a long-term server private key, SK server, providing to the server via the wireless device: i) a signature produced using a long-term eUICC public key, PK eUICC, and ii) PK eUICC, authenticating the server using PK server, generating, subsequent to the authenticating, an ephemeral eUICC public key, ePK eUICC, and an ephemeral eUICC private key, eSK eUICC, providing, to the server via the wireless device, a signed ePK eUICC that is signed using a long-term eUICC private key, SK eUICC, receiving, from the server via the wireless device, an ephemeral server public key, ePK server, that is signed using using SK server, generating a shared symmetric key using eSK eUICC and ePK server, and establishing the secure connection with the server using the shared symmetric key.