A computer-implemented method for key distribution of a data processing accelerator, the method comprising: receiving, at a host system from a data processing, DP, accelerator, an accelerator identifier, ID, that uniquely identifies the DP accelerator, wherein the host system is coupled to the DP accelerator over a bus; transmitting the accelerator ID to a predetermined trusted server over a network; receiving a certificate from the predetermined trusted server over the network, the certificate certifying the DP accelerator, wherein the certificate is be verified by verifying a certificate chain of the trusted server, and the certificate chain is an ordered list of certificates that enables to verify that the trusted server is trustworthy; extracting a public root key, PK_RK, from the certificate for verification, the PK_RK corresponding to a private root key, SK_RK, associated with the DP accelerator; and establishing a secure channel with the DP accelerator using the PK_RK based on the verification to exchange data securely between the host system and the DP accelerator, wherein when a user application or runtime libraries invokes a kernel to be executed by a DP accelerator and determines the kernel has not been updated onto the DP accelerator, the host system performs operations to verify the kernel before uploading the kernel to the DP accelerator, and a kernel object is sent, by a trusted execution environment, TEE, of the host system, to the DP accelerator if the kernel is verified to be trusted, wherein the kernel object includes the kernel, a kernel identifier, ID, and a signature for the kernel; wherein verifying the kernel includes: applying a public key to the signature of the kernel object to decrypt the signature to generate an expected hash value, the signature being an encrypted hash of the kernel; generating, by a kernel verifier module, a hash value for the kernel, and comparing to determine a difference of the expected hash value to the generated hash value; and if there is no difference, determining that the signature is valid. receiving, at a host system from a data processing, DP, accelerator, an accelerator identifier, ID, that uniquely identifies the DP accelerator, wherein the host system is coupled to the DP accelerator over a bus; transmitting the accelerator ID to a predetermined trusted server over a network; receiving a certificate from the predetermined trusted server over the network, the certificate certifying the DP accelerator, wherein the certificate is be verified by verifying a certificate chain of the trusted server, and the certificate chain is an ordered list of certificates that enables to verify that the trusted server is trustworthy; extracting a public root key, PK_RK, from the certificate for verification, the PK_RK corresponding to a private root key, SK_RK, associated with the DP accelerator; and establishing a secure channel with the DP accelerator using the PK_RK based on the verification to exchange data securely between the host system and the DP accelerator, wherein when a user application or runtime libraries invokes a kernel to be executed by a DP accelerator and determines the kernel has not been updated onto the DP accelerator, the host system performs operations to verify the kernel before uploading the kernel to the DP accelerator, and a kernel object is sent, by a trusted execution environment, TEE, of the host system, to the DP accelerator if the kernel is verified to be trusted, wherein the kernel object includes the kernel, a kernel identifier, ID, and a signature for the kernel; wherein verifying the kernel includes: applying a public key to the signature of the kernel object to decrypt the signature to generate an expected hash value, the signature being an encrypted hash of the kernel; generating, by a kernel verifier module, a hash value for the kernel, and comparing to determine a difference of the expected hash value to the generated hash value; and if there is no difference, determining that the signature is valid.