An Optical Line Terminal, OLT, comprising: • a receiver coupled to a Passive Optical Network, PON, and configured to receive a security key request from a Fiber Coaxial Unit, FCU, via the PON; wherein the receiver is further configured to receive an upstream message from a Coaxial Network Unit, CNU, via the FCU and an Ethernet PON over Coaxial, EPoC network; • a processor coupled to the receiver and configured to: generate a first security key responsive to the security key request from the FCU; encrypt the first security key in a security key response message; encrypt the downstream message with the first security key; decrypt the upstream message with the first security key; and initiate a switchover from the first security key to a second security key upon expiration of a timer; • a transmitter coupled to the processor and configured to transmit the security key response message comprising the encrypted first security key to the FCU via the PON, wherein the transmitter is further configured to transmit a downstream message toward the CNU via the FCU and the EPoC network, wherein the switchover comprises: generating and encrypting the second security key by the processor; transmitting the encrypted second security key toward the CNU by the transmitter; encrypting downstream traffic with the first security key by the processor until the receiver receives upstream traffic from the CNU that is encrypted with the second security key; and after receiving upstream traffic that is encrypted with the second security key, encrypting downstream traffic with the second security key by the processor. • a receiver coupled to a Passive Optical Network, PON, and configured to receive a security key request from a Fiber Coaxial Unit, FCU, via the PON; wherein the receiver is further configured to receive an upstream message from a Coaxial Network Unit, CNU, via the FCU and an Ethernet PON over Coaxial, EPoC network; • a processor coupled to the receiver and configured to: generate a first security key responsive to the security key request from the FCU; encrypt the first security key in a security key response message; encrypt the downstream message with the first security key; decrypt the upstream message with the first security key; and initiate a switchover from the first security key to a second security key upon expiration of a timer; generate a first security key responsive to the security key request from the FCU; encrypt the first security key in a security key response message; encrypt the downstream message with the first security key; decrypt the upstream message with the first security key; and initiate a switchover from the first security key to a second security key upon expiration of a timer; • a transmitter coupled to the processor and configured to transmit the security key response message comprising the encrypted first security key to the FCU via the PON, wherein the transmitter is further configured to transmit a downstream message toward the CNU via the FCU and the EPoC network, generating and encrypting the second security key by the processor; transmitting the encrypted second security key toward the CNU by the transmitter; encrypting downstream traffic with the first security key by the processor until the receiver receives upstream traffic from the CNU that is encrypted with the second security key; and after receiving upstream traffic that is encrypted with the second security key, encrypting downstream traffic with the second security key by the processor.